CVE-2023-24544
Description
Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
How to fix
- buffalo bs-gs2016p_firmware1.1.7.01 or later
- buffalo bs-gs2024p_firmware1.1.7.01 or later
- buffalo bs-gs2016hp_firmware1.1.7.01 or later
- buffalo bs-gs2024hp_firmware1.1.7.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buffalo bs-gsl2024_firmware | v ≤ 1.10-0.03 | — |
| buffalo bs-gsl2016p_firmware | v ≤ 1.10-0.03 | — |
| buffalo bs-gsl2016_firmware | v ≤ 1.10-0.03 | — |
| buffalo bs-gs2008_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2016_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2024_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2048_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2008p_firmware | v ≤ 1.0.10.01 | — |
| buffalo bs-gs2016p_firmware | v ≤ 1.0.10.01, v < 1.1.7.01 | 1.1.7.01 |
| buffalo bs-gs2024p_firmware | v ≤ 1.0.10.01, v < 1.1.7.01 | 1.1.7.01 |
| buffalo bs-gs2016hp_firmware | v < 1.1.7.01 | 1.1.7.01 |
| buffalo bs-gs2024hp_firmware | v < 1.1.7.01 | 1.1.7.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.