{"id":"CVE-2024-44072","aliases":["EUVD-2024-40849","GHSA-4gj3-5752-q8g8"],"status":"published","title":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN...","description":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00595,"percentile":0.48708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-09-10T06:56:44Z","modified":"2026-06-17T07:52:15Z","products":[{"vendor":"buffalo inc.","product":"wex-1166dhp"},{"vendor":"buffalo inc.","product":"wex-1166dhp2"},{"vendor":"buffalo inc.","product":"wex-1166dhps"},{"vendor":"buffalo inc.","product":"wex-300hps/n"},{"vendor":"buffalo inc.","product":"wex-300hptx/n"},{"vendor":"buffalo inc.","product":"wex-733dhp"},{"vendor":"buffalo inc.","product":"wex-733dhp2"},{"vendor":"buffalo inc.","product":"wex-733dhps"},{"vendor":"buffalo inc.","product":"wex-733dhptx"},{"vendor":"buffalo inc.","product":"whr-1166dhp"},{"vendor":"buffalo inc.","product":"whr-1166dhp2"},{"vendor":"buffalo inc.","product":"whr-1166dhp3"},{"vendor":"buffalo inc.","product":"whr-1166dhp4"},{"vendor":"buffalo inc.","product":"whr-300hp2"},{"vendor":"buffalo inc.","product":"whr-600d"},{"vendor":"buffalo inc.","product":"wmr-300"},{"vendor":"buffalo inc.","product":"wsr-1166dhp3"},{"vendor":"buffalo inc.","product":"wsr-600dhp"},{"vendor":"buffalo_inc","product":"wex_1166dhp"},{"vendor":"buffalo_inc","product":"wex_1166dhp2"},{"vendor":"buffalo_inc","product":"wex_1166dhps"},{"vendor":"buffalo_inc","product":"wex_300hpsn"},{"vendor":"buffalo_inc","product":"wex_300hptxn"},{"vendor":"buffalo_inc","product":"wex_733dhp"},{"vendor":"buffalo_inc","product":"wex_733dhp2"},{"vendor":"buffalo_inc","product":"wex_733dhps"},{"vendor":"buffalo_inc","product":"wex_733hptx"},{"vendor":"buffalo_inc","product":"whr_1166dhp"},{"vendor":"buffalo_inc","product":"whr_1166dhp2"},{"vendor":"buffalo_inc","product":"whr_1166dhp3"},{"vendor":"buffalo_inc","product":"whr_1166dhp4"},{"vendor":"buffalo_inc","product":"whr_300hp2"},{"vendor":"buffalo_inc","product":"whr_600d"},{"vendor":"buffalo_inc","product":"wmr_300"},{"vendor":"buffalo_inc","product":"wsr_1166dhp3"},{"vendor":"buffalo_inc","product":"wsr_600dhp"}],"references":[{"url":"https://www.buffalo.jp/news/detail/20240719-01.html"},{"url":"https://jvn.jp/en/jp/JVN12824024/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-44072"},{"url":"https://jvn.jp/en/jp/JVN12824024"},{"url":"https://github.com/advisories/GHSA-4gj3-5752-q8g8"}],"sources":{"cve":[{"id":"CVE-2024-44072","description":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.","status":"published","published":"2024-09-10T06:56:44.182Z","modified":"2024-09-10T19:58:39.14Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:06.48311Z"}],"euvd":[{"id":"EUVD-2024-40849","description":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.","status":"published","published":"2024-09-10T06:56:44Z","modified":"2024-09-10T19:58:39Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:58.744683Z"}],"ghsa":[{"id":"GHSA-4gj3-5752-q8g8","title":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN...","description":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.","status":"published","published":"2024-09-10T09:31:11Z","modified":"2024-09-10T21:32:43Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","level":"medium"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:58:13.590318Z"}],"nvd":[{"id":"CVE-2024-44072","description":"OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.","status":"published","published":"2024-09-10T07:15:01.963Z","modified":"2026-06-17T07:52:15.557Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:25.561537Z"}]}}