Read the docs
TI-2024-29659 Aliases CVE-2024-44072GHSA-4gj3-5752-q8g8

OS command injection in BUFFALO INC. WHR-1166DHP2

Priority LOW 29CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.

Summary

OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected product from the product's specific management page, an arbitrary OS command may be executed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BUFFALO INC.WHR-1166DHP2Ver. 2.95 and earlier—No fix listedCNA
BUFFALO INC.WHR-1166DHP3Ver. 2.95 and earlier—No fix listedCNA
BUFFALO INC.WHR-1166DHP4Ver. 2.95 and earlier—No fix listedCNA
BUFFALO INC.WSR-1166DHP3Ver. 1.18 and earlier—No fix listedCNA
BUFFALO INC.WSR-600DHPVer. 2.93 and earlier—No fix listedCNA
BUFFALO INC.WEX-300HPTX/NVer. 1.02 and earlier—No fix listedCNA
BUFFALO INC.WEX-733DHP2Ver. 1.03 and earlier—No fix listedCNA
BUFFALO INC.WEX-1166DHP2Ver. 1.05 and earlier—No fix listedCNA
BUFFALO INC.WEX-1166DHPSVer. 1.05 and earlier—No fix listedCNA
BUFFALO INC.WEX-300HPS/NVer. 1.02 and earlier—No fix listedCNA
BUFFALO INC.WEX-733DHPSVer. 1.02 and earlier—No fix listedCNA
BUFFALO INC.WEX-733DHPTXVer. 1.03 and earlier—No fix listedCNA
BUFFALO INC.WEX-1166DHPVer. 1.23 and earlier—No fix listedCNA
BUFFALO INC.WEX-733DHPVer. 1.64 and earlier—No fix listedCNA
BUFFALO INC.WHR-1166DHPVer. 2.92 and earlier—No fix listedCNA
BUFFALO INC.WHR-300HP2Ver. 2.51 and earlier—No fix listedCNA
BUFFALO INC.WHR-600DVer. 2.91 and earlier—No fix listedCNA
BUFFALO INC.WMR-300Ver. 2.50 and earlier—No fix listedCNA
  • WHR-1166DHP2 VendorBUFFALO INC. Affected Ver. 2.95 and earlier Fixed in — No fix listed CNA
  • WHR-1166DHP3 VendorBUFFALO INC. Affected Ver. 2.95 and earlier Fixed in — No fix listed CNA
  • WHR-1166DHP4 VendorBUFFALO INC. Affected Ver. 2.95 and earlier Fixed in — No fix listed CNA
  • WSR-1166DHP3 VendorBUFFALO INC. Affected Ver. 1.18 and earlier Fixed in — No fix listed CNA
  • WSR-600DHP VendorBUFFALO INC. Affected Ver. 2.93 and earlier Fixed in — No fix listed CNA
  • WEX-300HPTX/N VendorBUFFALO INC. Affected Ver. 1.02 and earlier Fixed in — No fix listed CNA
  • WEX-733DHP2 VendorBUFFALO INC. Affected Ver. 1.03 and earlier Fixed in — No fix listed CNA
  • WEX-1166DHP2 VendorBUFFALO INC. Affected Ver. 1.05 and earlier Fixed in — No fix listed CNA
  • WEX-1166DHPS VendorBUFFALO INC. Affected Ver. 1.05 and earlier Fixed in — No fix listed CNA
  • WEX-300HPS/N VendorBUFFALO INC. Affected Ver. 1.02 and earlier Fixed in — No fix listed CNA
  • WEX-733DHPS VendorBUFFALO INC. Affected Ver. 1.02 and earlier Fixed in — No fix listed CNA
  • WEX-733DHPTX VendorBUFFALO INC. Affected Ver. 1.03 and earlier Fixed in — No fix listed CNA
  • WEX-1166DHP VendorBUFFALO INC. Affected Ver. 1.23 and earlier Fixed in — No fix listed CNA
  • WEX-733DHP VendorBUFFALO INC. Affected Ver. 1.64 and earlier Fixed in — No fix listed CNA
  • WHR-1166DHP VendorBUFFALO INC. Affected Ver. 2.92 and earlier Fixed in — No fix listed CNA
  • WHR-300HP2 VendorBUFFALO INC. Affected Ver. 2.51 and earlier Fixed in — No fix listed CNA
  • WHR-600D VendorBUFFALO INC. Affected Ver. 2.91 and earlier Fixed in — No fix listed CNA
  • WMR-300 VendorBUFFALO INC. Affected Ver. 2.50 and earlier Fixed in — No fix listed CNA

CPE names CISA-ADP · 18

CPEVersionsRoleVendor
cpe:2.3:h:buffalo_inc:whr_1166dhp2:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:whr_1166dhp3:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:whr_1166dhp4:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wsr_1166dhp3:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wsr_600dhp:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_300hptxn:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_733dhp2:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_1166dhp2:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_1166dhps:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_300hpsn:*:*:*:*:*:*:*:*——Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_1166dhp2:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_1166dhp3:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_1166dhp4:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wsr_1166dhp3:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wsr_600dhp:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_300hptxn:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_733dhp2:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_1166dhp2:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_1166dhps:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_300hpsn:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:buffalo_inc:wex_733dhps:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_733hptx:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_1166dhp:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wex_733dhp:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:whr_1166dhp:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:whr_300hp2:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:whr_600d:*:*:*:*:*:*:*:*——Buffalo Inc
cpe:2.3:h:buffalo_inc:wmr_300:*:*:*:*:*:*:*:*——Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_733dhps:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_733hptx:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_1166dhp:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wex_733dhp:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_1166dhp:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_300hp2:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:whr_600d:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc
  • cpe:2.3:h:buffalo_inc:wmr_300:*:*:*:*:*:*:*:* Versions — — ·Buffalo Inc

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-44072
  2. 2026-10-03 Alias added: GHSA-4gj3-5752-q8g8

References

Other 2

  • TI-2021-03393 Path traversal in Buffalo WSR-2533DHPL2, Buffalo WSR-2533DHP3 KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-27920 An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code… CVSS 3.1HIGH 8.1
  • TI-2023-20705 An Issue in Buffalo America, Inc. CVSS 3.1HIGH 7.5
  • TI-2023-26723 Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote… CVSS 3.1HIGH 7.2
  • TI-2018-09572 Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows… CVSS 3.0CRITICAL 9.8
  • TI-2024-15530 Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may… CVSS 3.1CRITICAL 9.8
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences