CVE-2016-1135 - CVE House
Back to Database
Status published Medium CVE-2016-1135

Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware...

Vulnerability Description

Cross-site scripting (XSS) vulnerability on BUFFALO BHR-4GRV2 devices with firmware 1.04 and earlier, WEX-300 devices with firmware 1.90 and earlier, WHR-1166DHP devices with firmware 1.90 and earlier, WHR-300HP2 devices with firmware 1.90 and earlier, WHR-600D devices with firmware 1.90 and earlier, WMR-300 devices with firmware 1.90 and earlier, WMR-433 devices with firmware 1.01 and earlier, and WSR-1166DHP devices with firmware 1.01 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-1135

Credits & Attribution

No credits recorded in the NVD database.

References

More from buffalotech

View All →
CVE-2016-1134
Cross-site request forgery (CSRF) vulnerability on BUFFALO BHR-4GRV2 devices with...
High 8.8
CVE-2015-8262
Buffalo WZR-600DHP2 devices with firmware 2.09, 2.13, and 2.16 use...
Medium 6.8
CVE-2014-9284
The Buffalo WHR-1166DHP 1.60 and earlier, WSR-600DHP 1.60 and earlier,...
High 7.7
CVE-2011-1324
Multiple cross-site request forgery (CSRF) vulnerabilities in the management screen...
Medium 5.8
CVE-2007-4822
Cross-site request forgery (CSRF) vulnerability in the device management interface...
Medium 4.3

Affected Vendor

buffalotech

View all reports →

Affected Software

wmr-300 firmware, wex-300 firmware, wmr-433 firmware, bhr-4grv2 firmware, whr-300hp2 firmware, whr-1166dhp firmware, whr-600d firmware, wsr-1166dhp firmware
Vulnerable Versions:
1.90, 1.01, 1.04

Timeline

Official Publish: January 22nd, 2016
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.