Sign-up

ID

VAR-201708-0364


CVE

CVE-2017-10811


TITLE

WCR-1166DS vulnerable to OS command injection

Trust: 0.8

sources: JVNDB: JVNDB-2017-000192

DESCRIPTION

Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors. WCR-1166DS provided by BUFFALO INC.is a wireless LAN router. WCR-1166DS contains an OS command injection vulnerability (CWE-78). Masashi Shiraishi of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.A user who can access the administrative console of the device may execute an arbitrary OS command. Buffalo WCR-1166DS with firmware version 1.30 and earlier has a security vulnerability

Trust: 2.25

sources: NVD: CVE-2017-10811 // JVNDB: JVNDB-2017-000192 // CNVD: CNVD-2017-27316 // VULHUB: VHN-101171

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-27316

AFFECTED PRODUCTS

vendor:buffalomodel:wcr-1166dsscope:eqversion:1.30

Trust: 1.6

vendor:buffalomodel:wcr-1166dsscope:lteversion:firmware 1.30

Trust: 0.8

vendor:buffalomodel:wcr-1166dsscope:lteversion:<=1.30

Trust: 0.6

sources: CNVD: CNVD-2017-27316 // JVNDB: JVNDB-2017-000192 // CNNVD: CNNVD-201708-980 // NVD: CVE-2017-10811

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-10811
value: MEDIUM

Trust: 1.0

IPA: JVNDB-2017-000192
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-27316
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201708-980
value: HIGH

Trust: 0.6

VULHUB: VHN-101171
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-10811
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

IPA: JVNDB-2017-000192
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2017-27316
severity: MEDIUM
baseScore: 5.2
vectorString: AV:A/AC:L/AU:S/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 5.1
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-101171
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 5.1
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-10811
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 1.0

IPA: JVNDB-2017-000192
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2017-27316 // VULHUB: VHN-101171 // JVNDB: JVNDB-2017-000192 // CNNVD: CNNVD-201708-980 // NVD: CVE-2017-10811

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-101171 // JVNDB: JVNDB-2017-000192 // NVD: CVE-2017-10811

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201708-980

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201708-980

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-000192

PATCH
title:BUFFALO INC. websiteurl:http://buffalo.jp/support_s/s20170804_1.html
Trust: 0.8
title:Patch for WCR-1166DSOS Command Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/99783
Trust: 0.6
title:Buffalo WCR-1166DS Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74234
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-27316 // 
            
            
            
            JVNDB: JVNDB-2017-000192 // 
            
            
            
            CNNVD: CNNVD-201708-980

EXTERNAL IDS
db:JVNid:JVN05340005
Trust: 3.1
db:NVDid:CVE-2017-10811
Trust: 3.1
db:JVNDBid:JVNDB-2017-000192
Trust: 0.8
db:CNNVDid:CNNVD-201708-980
Trust: 0.7
db:CNVDid:CNVD-2017-27316
Trust: 0.6
db:VULHUBid:VHN-101171
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-27316 // 
            
            
            
            VULHUB: VHN-101171 // 
            
            
            
            JVNDB: JVNDB-2017-000192 // 
            
            
            
            CNNVD: CNNVD-201708-980 // 
            
            
            
            NVD: CVE-2017-10811

REFERENCES
url:https://jvn.jp/en/jp/jvn05340005/index.html
Trust: 2.5
url:http://buffalo.jp/support_s/s20170804_1.html
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-10811
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-10811
Trust: 0.8
url:http://jvn.jp/en/jp/jvn05340005/
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-27316 // 
            
            
            
            VULHUB: VHN-101171 // 
            
            
            
            JVNDB: JVNDB-2017-000192 // 
            
            
            
            CNNVD: CNNVD-201708-980 // 
            
            
            
            NVD: CVE-2017-10811

SOURCES
db:CNVDid:CNVD-2017-27316
db:VULHUBid:VHN-101171
db:JVNDBid:JVNDB-2017-000192
db:CNNVDid:CNNVD-201708-980
db:NVDid:CVE-2017-10811

LAST UPDATE DATE
2024-11-23T22:17:50.242000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-27316date:2017-09-19T00:00:00
db:VULHUBid:VHN-101171date:2017-08-25T00:00:00
db:JVNDBid:JVNDB-2017-000192date:2018-02-14T00:00:00
db:CNNVDid:CNNVD-201708-980date:2017-08-24T00:00:00
db:NVDid:CVE-2017-10811date:2024-11-21T03:06:33.180

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-27316date:2017-08-10T00:00:00
db:VULHUBid:VHN-101171date:2017-08-18T00:00:00
db:JVNDBid:JVNDB-2017-000192date:2017-08-08T00:00:00
db:CNNVDid:CNNVD-201708-980date:2017-08-24T00:00:00
db:NVDid:CVE-2017-10811date:2017-08-18T13:29:00.203