Buffalo LinkStation Username Enumeration Vulnerability via Insecure Direct Object Reference

A vulnerability in Buffalo LinkStation firmware version 1.85-0.01 allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. This issue is caused by improper access control in the '/nasapi' endpoint, which enables exploitation through Insecure Direct Object Reference (IDOR).

Impact

This vulnerability allows guest users to enumerate usernames, retrieve associated privilege roles, and access additional user metadata such as user IDs, categories, descriptions, quotas, and group information.

Remediation

Buffalo has acknowledged the vulnerability but will not release a patch. It is recommended to disable the guest user account to prevent unauthorized access.