CVE-2023-24464
Description
Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the product to execute arbitrary JavaScript on a legitimate user's web browser. The affected products and versions are as follows: BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buffalo bs-gs2008_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2016_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2024_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2048_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2008p_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2016p_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2024p_firmware | v ≤ 1.0.10.01 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.