Read the docs
TI-2016-04161 Aliases CVE-2016-4816GHSA-93m3-ch25-858f

BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow…

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other sensitive information via unspecified vectors.

Why it matters now

EPSS 0.01434 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 69

CPEVersionsRoleVendor
cpe:2.3:h:buffalo:wzr-600dhp3:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-600dhp3_firmware:*:*:*:*:*:*:*:*up to 2.16VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:hw-450hp-zwe:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:hw-450hp-zwe_firmware:*:*:*:*:*:*:*:*up to 1.91VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-hp-g450h:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-hp-g450h_firmware:*:*:*:*:*:*:*:*up to 1.87VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-450hp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-450hp_firmware:*:*:*:*:*:*:*:*up to 1.97VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-900dhp2:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-900dhp2_firmware:*:*:*:*:*:*:*:*up to 2.16VulnerableBUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-600dhp3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-600dhp3_firmware:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:hw-450hp-zwe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:hw-450hp-zwe_firmware:*:*:*:*:*:*:*:* Versions up to 1.91 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-hp-g450h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-hp-g450h_firmware:*:*:*:*:*:*:*:* Versions up to 1.87 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-450hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-450hp_firmware:*:*:*:*:*:*:*:* Versions up to 1.97 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-900dhp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-900dhp2_firmware:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·BUFFALO INC.
Show 59 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:buffalo:wcr-300:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wcr-300_firmware:*:*:*:*:*:*:*:*up to 1.86VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-450hp-cwt:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-450hp-cwt_firmware:*:*:*:*:*:*:*:*up to 1.92VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-hp-g301nh:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-hp-g301nh_firmware:*:*:*:*:*:*:*:*up to 1.81VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wxr-1750dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wxr-1750dhp_firmware:*:*:*:*:*:*:*:*up to 2.42VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-600dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-600dhp_firmware:1.97:*:*:*:*:*:*:*1.97VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-1750dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-1750dhp_firmware:*:*:*:*:*:*:*:*up to 2.28VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-s1750dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-s1750dhp_firmware:*:*:*:*:*:*:*:*up to 2.28VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:whr-300:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:whr-300_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-s600dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-s600dhp_firmware:*:*:*:*:*:*:*:*up to 2.16VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-hp-g302h:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-hp-g302h_firmware:*:*:*:*:*:*:*:*up to 1.83VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wapm-ag300n:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wapm-ag300n_firmware:*:*:*:*:*:*:*:*up to 2.62VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-hp-ag300h:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-hp-ag300h_firmware:*:*:*:*:*:*:*:*up to 1.73VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-d1100h:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-d1100h_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wpl-05g300:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wpl-05g300_firmware:*:*:*:*:*:*:*:*up to 1.86VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-s900dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-s900dhp_firmware:*:*:*:*:*:*:*:*up to 2.16VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:dwr-hp-g300nh:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:dwr-hp-g300nh_firmware:*:*:*:*:*:*:*:*up to 1.81VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:whr-300hp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:whr-300hp_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-1750dhp2:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-1750dhp2_firmware:*:*:*:*:*:*:*:*up to 2.28VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-1166dhp2:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-1166dhp2_firmware:*:*:*:*:*:*:*:*up to 2.13VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-300hp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-300hp_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wapm-apg300n:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wapm-apg300n_firmware:*:*:*:*:*:*:*:*up to 2.62VulnerableBUFFALO INC.
cpe:2.3:o:buffalo:wzr-900dhp2_firmware:*:*:*:*:*:*:*:*up to 1.13VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wxr-1900dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wxr-1900dhp_firmware:*:*:*:*:*:*:*:*up to 2.34VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-900dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-900dhp_firmware:*:*:*:*:*:*:*:*up to 1.11VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-1166dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-1166dhp_firmware:*:*:*:*:*:*:*:*up to 2.13VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:whr-hp-g300n:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:whr-hp-g300n_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:bhr-4grv:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:bhr-4grv_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-450hp-ub:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-450hp-ub_firmware:*:*:*:*:*:*:*:*up to 1.96VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:wzr-hp-g300nh:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:wzr-hp-g300nh_firmware:*:*:*:*:*:*:*:*up to 1.81VulnerableBUFFALO INC.
cpe:2.3:h:buffalo:fs-600dhp:-:*:*:*:*:*:*:*not specified by NVDRunning onBUFFALO INC.
cpe:2.3:o:buffalo:fs-600dhp_firmware:*:*:*:*:*:*:*:*up to 3.34VulnerableBUFFALO INC.
  • cpe:2.3:h:buffalo:wcr-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wcr-300_firmware:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-450hp-cwt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-450hp-cwt_firmware:*:*:*:*:*:*:*:* Versions up to 1.92 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-hp-g301nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-hp-g301nh_firmware:*:*:*:*:*:*:*:* Versions up to 1.81 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wxr-1750dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wxr-1750dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.42 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-600dhp_firmware:1.97:*:*:*:*:*:*:* Versions 1.97 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-1750dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-1750dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.28 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-s1750dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-s1750dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.28 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:whr-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:whr-300_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-s600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-s600dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-hp-g302h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-hp-g302h_firmware:*:*:*:*:*:*:*:* Versions up to 1.83 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wapm-ag300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wapm-ag300n_firmware:*:*:*:*:*:*:*:* Versions up to 2.62 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-hp-ag300h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-hp-ag300h_firmware:*:*:*:*:*:*:*:* Versions up to 1.73 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-d1100h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-d1100h_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wpl-05g300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wpl-05g300_firmware:*:*:*:*:*:*:*:* Versions up to 1.86 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-s900dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-s900dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.16 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:dwr-hp-g300nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:dwr-hp-g300nh_firmware:*:*:*:*:*:*:*:* Versions up to 1.81 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:whr-300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:whr-300hp_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-1750dhp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-1750dhp2_firmware:*:*:*:*:*:*:*:* Versions up to 2.28 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-1166dhp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-1166dhp2_firmware:*:*:*:*:*:*:*:* Versions up to 2.13 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-300hp_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wapm-apg300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wapm-apg300n_firmware:*:*:*:*:*:*:*:* Versions up to 2.62 Vulnerable ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-900dhp2_firmware:*:*:*:*:*:*:*:* Versions up to 1.13 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wxr-1900dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wxr-1900dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.34 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-900dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-900dhp_firmware:*:*:*:*:*:*:*:* Versions up to 1.11 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-1166dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-1166dhp_firmware:*:*:*:*:*:*:*:* Versions up to 2.13 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:whr-hp-g300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:whr-hp-g300n_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:bhr-4grv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:bhr-4grv_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-450hp-ub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-450hp-ub_firmware:*:*:*:*:*:*:*:* Versions up to 1.96 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:wzr-hp-g300nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:wzr-hp-g300nh_firmware:*:*:*:*:*:*:*:* Versions up to 1.81 Vulnerable ·BUFFALO INC.
  • cpe:2.3:h:buffalo:fs-600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
  • cpe:2.3:o:buffalo:fs-600dhp_firmware:*:*:*:*:*:*:*:* Versions up to 3.34 Vulnerable ·BUFFALO INC.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-4816
  2. 2026-10-03 Alias added: GHSA-93m3-ch25-858f

References

  • TI-2021-02471 Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware… CVSS 3.1HIGH 8.8
  • TI-2022-19509 Improper authentication in Buffalo network devices CVSS 3.1HIGH 8.8
  • TI-2022-18436 Hidden functionality vulnerability in multiple Buffalo network devices allows a… CVSS 3.1MEDIUM 6.8
  • TI-2021-02470 Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo… CVSS 3.1MEDIUM 4.3

Sources