CVE-2023-26588 : Use of hard-coded credentials vulnerability in Buffalo network devices allows an

Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier

Published 2023-04-11 09:15:08

Updated 2023-04-18 19:37:22

Source JPCERT/CC

View at NVD, CVE.org

Products affected by CVE-2023-26588

Buffalo » Bs-gsl2024 Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2024_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2024 » Version: N/A
Buffalo » Bs-gsl2016p Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2016p » Version: N/A
Buffalo » Bs-gsl2016 Firmware
Versions up to, including, (<=) 1.10-0.03
cpe:2.3:o:buffalo:bs-gsl2016_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2016 » Version: N/A
Buffalo » Bs-gs2008 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2008_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2008 » Version: N/A
Buffalo » Bs-gs2016 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2016_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016 » Version: N/A
Buffalo » Bs-gs2024 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2024_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024 » Version: N/A
Buffalo » Bs-gs2048 Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2048_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2048 » Version: N/A
Buffalo » Bs-gs2008p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2008p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2008p » Version: N/A
Buffalo » Bs-gs2016p Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016p » Version: N/A
Buffalo » Bs-gs2016p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2016p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016p » Version: N/A
Buffalo » Bs-gs2024p Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2024p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024p » Version: N/A
Buffalo » Bs-gs2024p Firmware
Versions up to, including, (<=) 1.0.10.01
cpe:2.3:o:buffalo:bs-gs2024p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024p » Version: N/A
Buffalo » Bs-gsl2005 Firmware
Versions before (<) 1.12-0.01
cpe:2.3:o:buffalo:bs-gsl2005_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2005 » Version: N/A
Buffalo » Bs-gsl2008 Firmware
Versions before (<) 1.12-0.01
cpe:2.3:o:buffalo:bs-gsl2008_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2008 » Version: N/A
Buffalo » Bs-gsl2005p Firmware
Versions before (<) 1.11-0.01
cpe:2.3:o:buffalo:bs-gsl2005p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2005p » Version: N/A
Buffalo » Bs-gsl2008p Firmware
Versions before (<) 1.11-0.01
cpe:2.3:o:buffalo:bs-gsl2008p_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gsl2008p » Version: N/A
Buffalo » Bs-gs2016hp Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2016hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2016hp » Version: N/A
Buffalo » Bs-gs2024hp Firmware
Versions before (<) 1.1.7.01
cpe:2.3:o:buffalo:bs-gs2024hp_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Buffalo » Bs-gs2024hp » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-26588

EPSS FAQ

0.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-26588

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-26588

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-26588

https://jvn.jp/en/vu/JVNVU96824262/

JVNVU#96824262: Multiple vulnerabilities in Buffalo network devices
Patch;Third Party Advisory

CVEs referencing this url
https://www.buffalo.jp/news/detail/20230310-01.html

【更新】スイッチの一部商品における複数の脆弱性とその対処方法 | バッファロー
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2023-26588

Products affected by CVE-2023-26588

Exploit prediction scoring system (EPSS) score for CVE-2023-26588

CVSS scores for CVE-2023-26588

CWE ids for CVE-2023-26588

References for CVE-2023-26588