CVE-2026-29516 is a vulnerability in Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior, classified as CWE-732 (Incorrect Permission Assignment for Critical Resource). Authenticated attackers can upload and execute a PHP file via the webserver, leveraging excessive permissions on the /etc/shadow file to read hashed passwords for all accounts including root. This vulnerability arises from world-readable permissions on a critical system file, allowing unauthorized access to sensitive credential data. The CVSS 4.0 base score is 6.9 (medium severity), with network attack vector, low attack complexity, and no user interaction required. No official patch or vendor advisory is provided in the data, and no known exploits are reported.

The vulnerability allows an authenticated attacker to access the /etc/shadow file, which contains hashed passwords for all user accounts including root. Exposure of these hashes could lead to offline password cracking attempts, potentially resulting in privilege escalation or unauthorized access to the device. The medium CVSS score reflects the significant confidentiality impact but requires authentication and some attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Buffalo's security advisories for firmware updates addressing this issue. Until a fix is available, restrict access to the webserver interface to trusted users only and consider disabling PHP file uploads if possible to reduce attack surface.