CVE-2016-1134 - CVE House
Back to Database
Status published High CVE-2016-1134

Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with...

Vulnerability Description

Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to hijack the authentication of arbitrary users.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1134

Credits & Attribution

No credits recorded in the NVD database.

References

More from buffalotech

View All →
CVE-2016-1135
Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware...
Medium 6.1
CVE-2015-8262
Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use...
Medium 6.8
CVE-2014-9284
The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier,...
High 7.7
CVE-2011-1324
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen...
Medium 5.8
CVE-2007-4822
Cross-site request forgery (CSRF) vulnerability in the device management interface...
Medium 4.3

Affected Vendor

buffalotech

View all reports →

Affected Software

whr-1166dhp firmware, whr-300hp2 firmware, wmr-300 firmware, bhr-4grv2 firmware, wex-300 firmware, whr-600d firmware, wmr-433 firmware, wsr-1166dhp firmware
Vulnerable Versions:
0

Timeline

Official Publish: January 22nd, 2016
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.