deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-43293
Published: 2023-04-11
Description: Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wacom\Wacom_Tablet.exe.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://cdn.wacom.com/u/productsupport/drivers/win/professional/releasenotes/Windows_6.4.2-1.html; https://github.com/LucaBarile/CVE-2022-43293; https://lucabarile.github.io/Blog/CVE-2022-43293/index.html
CVE: CVE-2023-24182
Published: 2023-04-11
Description: LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /system/sshkeys.js.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ABB-EL/external-vulnerability-disclosures/security/advisories/GHSA-7vqh-2r8q-rjg2; https://github.com/openwrt/luci/commit/0186d7eae0e123a409e9919a83fdfecc7945c984; https://github.com/openwrt/luci/commit/588381e[PII_REDACTED]cc3b20af33507052f1b58cb
CVE: CVE-2023-27191
Published: 2023-04-11
Description: An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-770
References: http://www.dualspace.com/pc/en/products.html; https://apkpure.com/cn/super-security-virus-cleaner/com.ludashi.security; https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27191/CVE%20detail.md
CVE: CVE-2023-28340
Published: 2023-04-11
Description: Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://manageengine.com; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-28340.html; https://manageengine.com
CVE: CVE-2023-28341
Published: 2023-04-11
Description: Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://manageengine.com; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2023-28341.html; https://manageengine.com
CVE: CVE-2023-1903
Published: 2023-04-11
Description: SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the restricted header data.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://launchpad.support.sap.com/#/notes/3301457; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3301457
CVE: CVE-2023-24527
Published: 2023-04-11
Description: SAP NetWeaver AS Java for Deploy Service - version 7.5, does not perform any access control checks for functionalities that require user identity enabling an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access a service which will enable them to access but not modify server settings and data with no effect on availability and integrity.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: https://launchpad.support.sap.com/#/notes/3287784; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3287784
CVE: CVE-2023-26458
Published: 2023-04-11
Description: An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-668
References: https://launchpad.support.sap.com/#/notes/3312733; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3312733
CVE: CVE-2023-27267
Published: 2023-04-11
Description: Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.


CVSS Score: 9.0 (CRITICAL)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/3305369; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3305369
CVE: CVE-2023-27497
Published: 2023-04-11
Description: Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/3305369; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3305369
CVE: CVE-2023-27499
Published: 2023-04-11
Description: SAP GUI for HTML - versions KERNEL 7.22, 7.53, 7.54, 7.77, 7.81, 7.85, 7.89, 7.91, KRNL64UC, 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT does not sufficiently encode user-controlled inputs, resulting in a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could craft a malicious URL and lure the victim to click, the script supplied by the attacker will execute in the victim user's browser. The information from the victim's web browser can either be modified or read and sent to the attacker.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://launchpad.support.sap.com/#/notes/3275458; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3275458
CVE: CVE-2023-27897
Published: 2023-04-11
Description: In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.


CVSS Score: 6.0 (MEDIUM)
CWE: CWE-94
References: https://launchpad.support.sap.com/#/notes/3309056; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3309056
CVE: CVE-2023-28761
Published: 2023-04-11
Description: In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading to limited impact on confidentiality and integrity.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/3289994; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3289994
CVE: CVE-2023-28763
Published: 2023-04-11
Description: SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.


CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://launchpad.support.sap.com/#/notes/3296378; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3296378
CVE: CVE-2023-28765
Published: 2023-04-11
Description: An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depending on the privileges of the BI user, the attacker can perform operations that can completely compromise the application.


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3298961; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3298961
CVE: CVE-2023-29108
Published: 2023-04-11
Description: The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources.


CVSS Score: 5.0 (MEDIUM)
CWE: CWE-923
References: https://launchpad.support.sap.com/#/notes/3315312; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3315312
CVE: CVE-2023-29109
Published: 2023-04-11
Description: The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula injection. An authorized attacker can inject arbitrary Excel formulas into fields like the Tooltip of the Custom Hints List. Once the victim opens the downloaded Excel document, the formula will be executed. As a result, an attacker can cause limited impact on the confidentiality and integrity of the application.


CVSS Score: 4.4 (MEDIUM)
CWE: CWE-1236
References: https://launchpad.support.sap.com/#/notes/3115598; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3115598
CVE: CVE-2023-29110
Published: 2023-04-11
Description: The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags. An authorized attacker can use some of the basic HTML codes such as heading, basic formatting and lists, then an attacker can inject images from the foreign domains. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.


CVSS Score: 3.7 (LOW)
CWE: CWE-80, CWE-79
References: https://launchpad.support.sap.com/#/notes/3113349; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3113349
CVE: CVE-2023-29111
Published: 2023-04-11
Description: The SAP AIF (ODATA service) - versions 755, 756, discloses more detailed information than is required. An authorized attacker can use the collected information possibly to exploit the component. As a result, an attacker can cause a low impact on the confidentiality of the application.


CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/3117978; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3117978
CVE: CVE-2023-29112
Published: 2023-04-11
Description: The SAP Application Interface (Message Monitoring) - versions 600, 700, allows an authorized attacker to input links or headings with custom CSS classes into a comment. The comment will render links and custom CSS classes as HTML objects. After successful exploitations, an attacker can cause limited impact on the confidentiality and integrity of the application.


CVSS Score: 3.7 (LOW)
CWE: CWE-80, CWE-79
References: https://launchpad.support.sap.com/#/notes/3114489; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3114489
CVE: CVE-2023-29185
Published: 2023-04-11
Description: SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources sufficiently to make it unavailable over the network without any user interaction.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://launchpad.support.sap.com/#/notes/3303060; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3303060
CVE: CVE-2023-29186
Published: 2023-04-11
Description: In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a report to upload and overwrite files on the SAP server. Data cannot be read but if a remote attacker has sufficient (administrative) privileges then potentially critical OS files can be overwritten making the system unavailable.


CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/3305907; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3305907
CVE: CVE-2023-29187
Published: 2023-04-11
Description: A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the attackers control.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-427
References: https://launchpad.support.sap.com/#/notes/3311624; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3311624
CVE: CVE-2023-29189
Published: 2023-04-11
Description: SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server. This application is exposed over the network and successful exploitation can lead to exposure of form fields


CVSS Score: 5.4 (MEDIUM)
CWE: CWE-23
References: https://launchpad.support.sap.com/#/notes/3269352; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://launchpad.support.sap.com/#/notes/3269352
CVE: CVE-2023-26121
Published: 2023-04-11
Description: All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321, CWE-1321, CWE-1321
References: https://gist.github.com/seongil-wi/9d9fc0cc5b7b130419cd45827e59c4f9; https://github.com/hacksparrow/safe-eval/issues/28; https://security.snyk.io/vuln/SNYK-JS-SAFEEVAL-3373062
CVE: CVE-2023-26122
Published: 2023-04-11
Description: All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation.Exploiting this vulnerability might result in remote code execution ("RCE").**Vulnerable functions:**__defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(),  valueOf().
CVSS Score: 8.8 (HIGH)
CWE: CWE-265, CWE-1321, CWE-1321
References: https://gist.github.com/seongil-wi/2db6cb884e10137a93132b7f74879cce; https://github.com/hacksparrow/safe-eval/issues/27; https://github.com/hacksparrow/safe-eval/issues/31
CVE: CVE-2023-29492
Published: 2023-04-11
Description: Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-29492
CVE: CVE-2023-22282
Published: 2023-04-11
Description: WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service.
CVSS Score: 7.3 (HIGH)
CWE: CWE-428, CWE-428
References: https://jvn.jp/en/jp/JVN35246979/; https://www.elecom.co.jp/news/security/20230324-01/; https://jvn.jp/en/jp/JVN35246979/
CVE: CVE-2023-22429
Published: 2023-04-11
Description: Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which may allow a local attacker to obtain the hard-coded API key via reverse-engineering the application binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://jvn.jp/en/jp/JVN64453490/; https://play.google.com/store/apps/details?id=com.wolt.android&hl=en_US&gl=US; https://jvn.jp/en/jp/JVN64453490/
CVE: CVE-2023-23572
Published: 2023-04-11
Description: Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. [Note] Web Config is the software that allows users to check the status and change the settings of SEIKO EPSON printers/network interface via a web browser. According to SEIKO EPSON CORPORATION, it is also called as Remote Manager in some products. Web Config is pre-installed in some printers/network interface provided by SEIKO EPSON CORPORATION. For the details of the affected product names/model numbers, refer to the information provided by the vendor.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/jp/JVN82424996/; https://www.epson.jp/support/misc_t/230308_oshirase.htm; https://jvn.jp/en/jp/JVN82424996/
CVE: CVE-2023-23575
Published: 2023-04-11
Description: Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction and access Network Maintenance page, which may result in obtaining the network information of the product. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://jvn.jp/en/vu/JVNVU96198617/; https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf; https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware
CVE: CVE-2023-24464
Published: 2023-04-11
Description: Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://jvn.jp/en/vu/JVNVU96824262/; https://www.buffalo.jp/news/detail/20230310-01.html; https://jvn.jp/en/vu/JVNVU96824262/
CVE: CVE-2023-24544
Published: 2023-04-11
Description: Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
CVSS Score: 8.1 (HIGH)
CWE: CWE-284
References: https://jvn.jp/en/vu/JVNVU96824262/; https://www.buffalo.jp/news/detail/20230310-01.html; https://jvn.jp/en/vu/JVNVU96824262/
CVE: CVE-2023-25755
Published: 2023-04-11
Description: Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory buffer (CWE-119) due to improper check of its data size when processing a project file. If a user of Screen Creator Advance 2 opens a specially crafted project file, information may be disclosed and/or arbitrary code may be executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: https://jvn.jp/en/vu/JVNVU99710864/; https://www.electronics.jtekt.co.jp/en/topics/[PII_REDACTED]11/; https://jvn.jp/en/vu/JVNVU99710864/
CVE: CVE-2023-25950
Published: 2023-04-11
Description: HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive information or cause a denial-of-service (DoS) condition.
CVSS Score: 7.3 (HIGH)
CWE: CWE-444, CWE-444
References: https://git.haproxy.org/?p=haproxy-2.7.git%3Ba=commit%3Bh=3ca4223c5e1f18a19dc93b0b09ffdbd295554d46; https://jvn.jp/en/jp/JVN38170084/; https://www.haproxy.org/
CVE: CVE-2023-25955
Published: 2023-04-11
Description: National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). By processing a specially crafted XML file, arbitrary files on the PC may be accessed by an attacker.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: https://jvn.jp/en/jp/JVN75742861/; https://nlftp.mlit.go.jp/i_news.html#news4; https://jvn.jp/en/jp/JVN75742861/
CVE: CVE-2023-26588
Published: 2023-04-11
Description: Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-668
References: https://jvn.jp/en/vu/JVNVU96824262/; https://www.buffalo.jp/news/detail/20230310-01.html; https://jvn.jp/en/vu/JVNVU96824262/