Search
Find a vulnerability
Search criteria
3 vulnerabilities found for bhr-4grv2 by buffalotech
VAR-201506-0008
Vulnerability from variot - Updated: 2025-04-13 23:32The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Masashi Sakai, Satoshi Ogawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An authenticated attacker may be able to execute arbitrary OS commands. Buffalo WHR-1166DHP, etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201506-0008",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wsr-600dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "wsr-600dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.60"
},
{
"model": "whr-1166dhp",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wsr-600dhp",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-600d",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-300hp2",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wmr-300",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wex-300",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "bhr-4grv2",
"scope": "lt",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "wsr-600dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wex-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": "1.60"
},
{
"model": "technology wsr-600dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology bhr-4grv2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.04"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "BID",
"id": "75062"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:buffalo_inc:bhr-4grv2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:wex-300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:whr-1166dhp",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:whr-300hp2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:whr-600d",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:wmr-300",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:buffalo_inc:wsr-600dhp",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Masashi Sakai, and Satoshi Ogawa.",
"sources": [
{
"db": "BID",
"id": "75062"
}
],
"trust": 0.3
},
"cve": "CVE-2014-9284",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 7.7,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 5.1,
"id": "CVE-2014-9284",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "IPA",
"availabilityImpact": "Partial",
"baseScore": 5.2,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "JVNDB-2015-000085",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CNVD-2015-03768",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.7,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 5.1,
"id": "VHN-77229",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:A/AC:L/AU:S/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-9284",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2015-000085",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-03768",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201506-119",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-77229",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "VULHUB",
"id": "VHN-77229"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier, WHR-600D 1.60 and earlier, WHR-300HP2 1.60 and earlier, WMR-300 1.60 and earlier, WEX-300 1.60 and earlier, and BHR-4GRV2 1.04 and earlier routers allow remote authenticated users to execute arbitrary OS commands via unspecified vectors. Multiple wireless LAN routers provided by BUFFALO INC. contain an OS command injection vulnerability. Masashi Sakai, Satoshi Ogawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An authenticated attacker may be able to execute arbitrary OS commands. Buffalo WHR-1166DHP, etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-9284"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "BID",
"id": "75062"
},
{
"db": "VULHUB",
"id": "VHN-77229"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "JVN",
"id": "JVN50447904",
"trust": 3.4
},
{
"db": "NVD",
"id": "CVE-2014-9284",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085",
"trust": 3.4
},
{
"db": "BID",
"id": "75062",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-03768",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-77229",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "VULHUB",
"id": "VHN-77229"
},
{
"db": "BID",
"id": "75062"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"id": "VAR-201506-0008",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "VULHUB",
"id": "VHN-77229"
}
],
"trust": 1.338095253846154
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
}
]
},
"last_update_date": "2025-04-13T23:32:45.529000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://www.buffalotech.com/select-your-region#"
},
{
"title": "Patches for arbitrary Buffalo router arbitrary command execution vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/59524"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-77229"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://jvn.jp/en/jp/jvn50447904/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2015-000085"
},
{
"trust": 0.9,
"url": "http://jvndb.jvn.jp/en/contents/2015/jvndb-2015-000085.html"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9284"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9284"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "VULHUB",
"id": "VHN-77229"
},
{
"db": "BID",
"id": "75062"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"db": "VULHUB",
"id": "VHN-77229"
},
{
"db": "BID",
"id": "75062"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-06-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"date": "2015-06-09T00:00:00",
"db": "VULHUB",
"id": "VHN-77229"
},
{
"date": "2015-06-05T00:00:00",
"db": "BID",
"id": "75062"
},
{
"date": "2015-06-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"date": "2015-06-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"date": "2015-06-09T00:59:00.073000",
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-06-12T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-03768"
},
{
"date": "2015-06-16T00:00:00",
"db": "VULHUB",
"id": "VHN-77229"
},
{
"date": "2015-06-05T00:00:00",
"db": "BID",
"id": "75062"
},
{
"date": "2015-06-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-000085"
},
{
"date": "2015-06-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201506-119"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-9284"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Buffalo wireless LAN routers vulnerable to OS command injection",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-000085"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201506-119"
}
],
"trust": 0.6
}
}
VAR-201601-0400
Vulnerability from variot - Updated: 2025-04-13 23:29Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Multiple network devices provided by BUFFALO INC. contain a cross-site scripting vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the logged in user's web browser. Buffalo is the wireless router product of the Buffalo Group. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Buffalo BHR-4GRV2 etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201601-0400",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "whr-600d",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wex-300",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wex-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "technology wsr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology bhr-4grv2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.04"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:buffalo_inc:bhr-4grv2_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wex-300_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-1166dhp_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-300hp2_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-600d_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wmr-300_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wmr-433_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wsr-1166dhp_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc.",
"sources": [
{
"db": "BID",
"id": "81548"
}
],
"trust": 0.3
},
"cve": "CVE-2016-1135",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CVE-2016-1135",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000006",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2016-00707",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-89954",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2016-1135",
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 6.1,
"baseSeverity": "Medium",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "JVNDB-2016-000006",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-1135",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2016-000006",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-00707",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201601-605",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-89954",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Multiple network devices provided by BUFFALO INC. contain a cross-site scripting vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the logged in user\u0027s web browser. Buffalo is the wireless router product of the Buffalo Group. A remote attacker can exploit this vulnerability to inject arbitrary web scripts or HTML. \nAn attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Buffalo BHR-4GRV2 etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1135"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "VULHUB",
"id": "VHN-89954"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1135",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVN49225722",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00707",
"trust": 0.6
},
{
"db": "BID",
"id": "81548",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-89954",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"id": "VAR-201601-0400",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
}
],
"trust": 1.3471707
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
}
]
},
"last_update_date": "2025-04-13T23:29:30.965000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20141030_2.html"
},
{
"title": "Patches for multiple Buffalo product cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/70910"
},
{
"title": "Multiple Buffalo Fixes for product cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59923"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://jvn.jp/en/jp/jvn49225722/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2016-000006"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1135"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1135"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/products/wireless/wireless-n-routers-access-points/"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"db": "VULHUB",
"id": "VHN-89954"
},
{
"db": "BID",
"id": "81548"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-01-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"date": "2016-01-22T00:00:00",
"db": "VULHUB",
"id": "VHN-89954"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81548"
},
{
"date": "2016-01-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"date": "2016-01-22T11:59:06.307000",
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-01-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00707"
},
{
"date": "2016-03-11T00:00:00",
"db": "VULHUB",
"id": "VHN-89954"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81548"
},
{
"date": "2016-03-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000006"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-605"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-1135"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Buffalo network devices vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000006"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-605"
}
],
"trust": 0.6
}
}
VAR-201601-0399
Vulnerability from variot - Updated: 2025-04-13 23:21Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users. Multiple network devices provided by BUFFALO INC. contain a cross-site request forgery vulnerability (CWE-352). Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Buffalo BHR-4GRV2 and so on are all wireless router products of Buffalo Group of Japan. A remote attacker could exploit this vulnerability to perform unauthorized operations. This may aid in other attacks. Buffalo BHR-4GRV2 etc
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201601-0399",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "whr-600d",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.04"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.90"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 1.0,
"vendor": "buffalotech",
"version": "1.01"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.8,
"vendor": "buffalo",
"version": "ver.1.01"
},
{
"model": "bhr-4grv2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.04"
},
{
"model": "wex-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-300hp2",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "whr-600d",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-300",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.90"
},
{
"model": "wmr-433",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "wsr-1166dhp",
"scope": "lte",
"trust": 0.6,
"vendor": "buffalo",
"version": "\u003c=1.01"
},
{
"model": "whr-600d",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-300hp2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wex-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "whr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-300",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wsr-1166dhp",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "wmr-433",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "bhr-4grv2",
"scope": "eq",
"trust": 0.6,
"vendor": "buffalotech",
"version": null
},
{
"model": "technology wsr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-433",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.01"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wmr-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-600d",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-300hp2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.80"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.70"
},
{
"model": "technology whr-1166dhp",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.90"
},
{
"model": "technology wex-300",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.60"
},
{
"model": "technology bhr-4grv2",
"scope": "eq",
"trust": 0.3,
"vendor": "buffalo",
"version": "1.04"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:buffalo_inc:bhr-4grv2_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wex-300_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-1166dhp_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-300hp2_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:whr-600d_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wmr-300_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wmr-433_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:buffalo_inc:wsr-1166dhp_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai",
"sources": [
{
"db": "BID",
"id": "81550"
}
],
"trust": 0.3
},
"cve": "CVE-2016-1134",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2016-1134",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 2.6,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000005",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 4.9,
"id": "CNVD-2016-00775",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-89953",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2016-1134",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "IPA",
"availabilityImpact": "None",
"baseScore": 4.3,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2016-000005",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-1134",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "IPA",
"id": "JVNDB-2016-000005",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2016-00775",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201601-604",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-89953",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users. Multiple network devices provided by BUFFALO INC. contain a cross-site request forgery vulnerability (CWE-352). Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. and Masashi Sakai reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Buffalo BHR-4GRV2 and so on are all wireless router products of Buffalo Group of Japan. A remote attacker could exploit this vulnerability to perform unauthorized operations. This may aid in other attacks. Buffalo BHR-4GRV2 etc",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-1134"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "VULHUB",
"id": "VHN-89953"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-1134",
"trust": 3.4
},
{
"db": "JVN",
"id": "JVN09268287",
"trust": 2.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005",
"trust": 2.5
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2016-00775",
"trust": 0.6
},
{
"db": "BID",
"id": "81550",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-89953",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"id": "VAR-201601-0399",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
}
],
"trust": 1.3471707
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
}
]
},
"last_update_date": "2025-04-13T23:21:09.933000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "BUFFALO INC. website",
"trust": 0.8,
"url": "http://buffalo.jp/support_s/s20141030_1.html"
},
{
"title": "Patches for cross-site request forgery vulnerabilities for multiple Buffalo devices",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/71069"
},
{
"title": "Multiple Buffalo Fixing measures for device cross-site request forgery vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59922"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://jvn.jp/en/jp/jvn09268287/index.html"
},
{
"trust": 1.7,
"url": "http://jvndb.jvn.jp/jvndb/jvndb-2016-000005"
},
{
"trust": 1.4,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1134"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1134"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/products/wireless/wireless-n-routers-access-points/"
},
{
"trust": 0.3,
"url": "http://www.buffalotech.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"db": "VULHUB",
"id": "VHN-89953"
},
{
"db": "BID",
"id": "81550"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-02-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"date": "2016-01-22T00:00:00",
"db": "VULHUB",
"id": "VHN-89953"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81550"
},
{
"date": "2016-01-22T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"date": "2016-01-22T11:59:05.117000",
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-02-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-00775"
},
{
"date": "2016-03-14T00:00:00",
"db": "VULHUB",
"id": "VHN-89953"
},
{
"date": "2016-01-22T00:00:00",
"db": "BID",
"id": "81550"
},
{
"date": "2016-03-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-000005"
},
{
"date": "2016-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201601-604"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-1134"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Buffalo network devices vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-000005"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201601-604"
}
],
"trust": 0.6
}
}