Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware…
Priority MEDIUM 40Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior) allows remote unauthenticated attackers to bypass access restriction and to start telnet service and execute arbitrary OS commands with root privileges via unspecified vectors.
Why it matters now
EPSS 0.00857 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BUFFALO INC. | Buffalo broadband routers | BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior | — | No fix listed | CNA |
- Buffalo broadband routers VendorBUFFALO INC. Affected BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 and prior, HW-450HP-ZWE firmware Ver.1.99 and prior, WHR-300HP firmware Ver.1.99 and prior, WHR-300 firmware Ver.1.99 and prior, WHR-G301N firmware Ver.1.86 and prior, WHR-HP-G300N firmware Ver.1.99 and prior, WHR-HP-GN firmware Ver.1.86 and prior, WPL-05G300 firmware Ver.1.87 and prior, WZR-450HP-CWT firmware Ver.1.99 and prior, WZR-450HP-UB firmware Ver.1.99 and prior, WZR-HP-AG300H firmware Ver.1.75 and prior, WZR-HP-G300NH firmware Ver.1.83 and prior, WZR-HP-G301NH firmware Ver.1.83 and prior, WZR-HP-G302H firmware Ver.1.85 and prior, WZR-HP-G450H firmware Ver.1.89 and prior, WZR-300HP firmware Ver.1.99 and prior, WZR-450HP firmware Ver.1.99 and prior, WZR-600DHP firmware Ver.1.99 and prior, WZR-D1100H firmware Ver.1.99 and prior, FS-HP-G300N firmware Ver.3.32 and prior, FS-600DHP firmware Ver.3.38 and prior, FS-R600DHP firmware Ver.3.39 and prior, and FS-G300N firmware Ver.3.13 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 48
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:buffalo:bhr-4grv_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:bhr-4grv:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:dwr-hp-g300nh_firmware:*:*:*:*:*:*:*:* | before 1.84 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:dwr-hp-g300nh:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:hw-450hp-zwe_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:hw-450hp-zwe:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:whr-300hp_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:whr-300hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:whr-300_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:whr-300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
- cpe:2.3:o:buffalo:bhr-4grv_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:bhr-4grv:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:dwr-hp-g300nh_firmware:*:*:*:*:*:*:*:* Versions before 1.84 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:dwr-hp-g300nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:hw-450hp-zwe_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:hw-450hp-zwe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:whr-300hp_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:whr-300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:whr-300_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:whr-300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
Show 38 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:buffalo:whr-g301n_firmware:*:*:*:*:*:*:*:* | before 1.87 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:whr-g301n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:whr-hp-g300n_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:whr-hp-g300n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:whr-hp-gn_firmware:*:*:*:*:*:*:*:* | before 1.87 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:whr-hp-gn:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wpl-05g300_firmware:*:*:*:*:*:*:*:* | before 1.88 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wpl-05g300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-450hp-cwt_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-450hp-cwt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-450hp-ub_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-450hp-ub:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-hp-ag300h_firmware:*:*:*:*:*:*:*:* | before 1.76 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-hp-ag300h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-hp-g300nh_firmware:*:*:*:*:*:*:*:* | before 1.84 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-hp-g300nh:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-hp-g301nh_firmware:*:*:*:*:*:*:*:* | before 1.84 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-hp-g301nh:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-hp-g302h_firmware:*:*:*:*:*:*:*:* | before 1.86 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-hp-g302h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-hp-g450h_firmware:*:*:*:*:*:*:*:* | before 1.90 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-hp-g450h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-300hp_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-300hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-450hp_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-450hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-600dhp_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-600dhp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:wzr-d1100h_firmware:*:*:*:*:*:*:*:* | before 2.00 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:wzr-d1100h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:fs-hp-g300n_firmware:*:*:*:*:*:*:*:* | before 3.33 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:fs-hp-g300n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:fs-600dhp_firmware:*:*:*:*:*:*:*:* | before 3.40 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:fs-600dhp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:fs-r600dhp_firmware:*:*:*:*:*:*:*:* | before 3.40 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:fs-r600dhp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
| cpe:2.3:o:buffalo:fs-g300n_firmware:*:*:*:*:*:*:*:* | before 3.14 | Vulnerable | BUFFALO INC. |
| cpe:2.3:h:buffalo:fs-g300n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | BUFFALO INC. |
- cpe:2.3:o:buffalo:whr-g301n_firmware:*:*:*:*:*:*:*:* Versions before 1.87 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:whr-g301n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:whr-hp-g300n_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:whr-hp-g300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:whr-hp-gn_firmware:*:*:*:*:*:*:*:* Versions before 1.87 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:whr-hp-gn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wpl-05g300_firmware:*:*:*:*:*:*:*:* Versions before 1.88 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wpl-05g300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-450hp-cwt_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-450hp-cwt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-450hp-ub_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-450hp-ub:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-hp-ag300h_firmware:*:*:*:*:*:*:*:* Versions before 1.76 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-hp-ag300h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-hp-g300nh_firmware:*:*:*:*:*:*:*:* Versions before 1.84 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-hp-g300nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-hp-g301nh_firmware:*:*:*:*:*:*:*:* Versions before 1.84 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-hp-g301nh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-hp-g302h_firmware:*:*:*:*:*:*:*:* Versions before 1.86 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-hp-g302h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-hp-g450h_firmware:*:*:*:*:*:*:*:* Versions before 1.90 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-hp-g450h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-300hp_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-450hp_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-450hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-600dhp_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:wzr-d1100h_firmware:*:*:*:*:*:*:*:* Versions before 2.00 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:wzr-d1100h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:fs-hp-g300n_firmware:*:*:*:*:*:*:*:* Versions before 3.33 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:fs-hp-g300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:fs-600dhp_firmware:*:*:*:*:*:*:*:* Versions before 3.40 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:fs-600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:fs-r600dhp_firmware:*:*:*:*:*:*:*:* Versions before 3.40 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:fs-r600dhp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
- cpe:2.3:o:buffalo:fs-g300n_firmware:*:*:*:*:*:*:*:* Versions before 3.14 Vulnerable ·BUFFALO INC.
- cpe:2.3:h:buffalo:fs-g300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·BUFFALO INC.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3512
- 2026-10-03 Alias added: GHSA-m7x4-xmjq-8hxp
References
More BUFFALO INC. Bhr-4grv Firmware vulnerabilities
- TI-2022-19509 Improper authentication in Buffalo network devices CVSS 3.1HIGH 8.8
- TI-2016-04161 BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow… CVSS 3.0MEDIUM 6.5
- TI-2022-18436 Hidden functionality vulnerability in multiple Buffalo network devices allows a… CVSS 3.1MEDIUM 6.8
- TI-2021-02470 Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo… CVSS 3.1MEDIUM 4.3
Sources
- CVE-2021-3512 · CVE Program
- CVE-2021-3512 · NVD
- FIRST EPSS
- GHSA-m7x4-xmjq-8hxp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences