BUFFALO Wi-Fi Routers Hidden Functionality Vulnerability Allowing OS Command Execution

A vulnerability exists in multiple BUFFALO Wi-Fi router products, allowing an attacker to access the router's debugging functionality and execute arbitrary operating system commands. This issue is linked to a dependency on a vulnerable third-party component, mini_httpd, which has its own known vulnerability (CVE-2015-1548) that could lead to information leakage.

Impact

Exploitation of this vulnerability could result in unauthorized access to the router's debugging features, enabling the execution of arbitrary OS commands on the device.

Remediation

Users are advised to update the router's firmware to the latest version. Instructions for downloading the update are available on the BUFFALO support website. If the automatic update feature is enabled, the router will have been updated automatically.