Multiple Buffalo Routers Cross-Site Request Forgery Vulnerability

Bugtraq ID:	47893
Class:	Design Error
CVE:	CVE-2011-1324
Remote:	Yes
Local:	No
Published:	May 17 2011 12:00AM
Updated:	May 17 2011 12:00AM
Credit:	Hirotaka Katagiri
Vulnerable:	Buffalo Technology Wireless-N NFINITI WZR-HP-G300NH Buffalo Technology Wireless-N NFINITI WZR-HP-G300NH Buffalo Technology Wireless-N NFINITI WHR-HP-G300N Buffalo Technology Wireless-N NFINITI WHR-G300U Buffalo Technology Wireless-N NFINITI WHR-G300N Buffalo Technology Wireless Broadband Router WBRG54 1.13 Buffalo Technology Wireless Broadband Router WBRG54 1.11 Buffalo Technology WHR-G54S 1.2 Buffalo Technology Airstation WHR-G54S 1.2
Not Vulnerable:

Multiple Buffalo Routers Cross-Site Request Forgery Vulnerability

Multiple Buffalo routers are prone to a cross-site request-forgery vulnerability.

Successful exploits can result in privileged commands running on the affected devices, including enabling remote access to the web administration interface. This may lead to further network-based attacks.

Multiple Buffalo Routers Cross-Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.

Multiple Buffalo Routers Cross-Site Request Forgery Vulnerability

Solution:
Updates are available. Please contact the vendor for more information.

Multiple Buffalo Routers Cross-Site Request Forgery Vulnerability

References:

• Buffalo Home page (Buffalo Technology)
  
• JVN#50505257 Multiple Buffalo routers vulnerable to cross-site request forgery (JPCERT/CC and IPA)