CVE-2023-24544 : Improper access control vulnerability in Buffalo network devices allows a networ

Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier

Published 2023-04-11 09:15:08

Updated 2023-04-18 19:36:20

Source JPCERT/CC

View at NVD, CVE.org

Products affected by CVE-2023-24544

Buffalo » Bs-gsl2024 Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2024_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2024 » Version: N/A
Buffalo » Bs-gsl2016p Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2016p » Version: N/A
Buffalo » Bs-gsl2016 Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2016_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2016 » Version: N/A
Buffalo » Bs-gs2008 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2008_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2008 » Version: N/A
Buffalo » Bs-gs2016 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2016_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016 » Version: N/A
Buffalo » Bs-gs2024 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2024_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024 » Version: N/A
Buffalo » Bs-gs2048 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2048_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2048 » Version: N/A
Buffalo » Bs-gs2008p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2008p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2008p » Version: N/A
Buffalo » Bs-gs2016p Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016p » Version: N/A
Buffalo » Bs-gs2016p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016p » Version: N/A
Buffalo » Bs-gs2024p Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2024p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024p » Version: N/A
Buffalo » Bs-gs2024p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2024p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024p » Version: N/A
Buffalo » Bs-gs2016hp Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2016hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016hp » Version: N/A
Buffalo » Bs-gs2024hp Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2024hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024hp » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-24544

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-24544

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.1	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

References for CVE-2023-24544

https://jvn.jp/en/vu/JVNVU96824262/

JVNVU#96824262: Multiple vulnerabilities in Buffalo network devices
Third Party Advisory

CVEs referencing this url
https://www.buffalo.jp/news/detail/20230310-01.html

【更新】スイッチの一部商品における複数の脆弱性とその対処方法 | バッファロー
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-24544

Products affected by CVE-2023-24544

Exploit prediction scoring system (EPSS) score for CVE-2023-24544

CVSS scores for CVE-2023-24544

References for CVE-2023-24544