Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.

CVE-2022-43464 is a high-severity vulnerability affecting UNIMO Technology Co., Ltd's network devices models UDR-JA1604, UDR-JA1608, and UDR-JA1616 running firmware versions 71x10.1.107112.43A and earlier. The vulnerability arises from hidden functionality embedded within the firmware that allows a remote attacker, who has authenticated access, to execute arbitrary operating system commands on the affected device or modify device settings. This is classified under CWE-78, which pertains to OS command injection vulnerabilities. The attack vector is network-based (AV:N), requiring low attack complexity (AC:L) and privileges (PR:L), but does not require user interaction (UI:N). The vulnerability impacts confidentiality, integrity, and availability (C:H/I:H/A:H), meaning an attacker can fully compromise the device’s operation and data. Although no public exploits have been reported in the wild, the potential for severe impact exists due to the ability to execute arbitrary commands remotely. The lack of available patches at the time of disclosure increases the risk for organizations using these devices. The vulnerability scope is unchanged (S:U), indicating the impact is limited to the vulnerable device itself. These devices are likely used in network infrastructure roles, making them critical points for security within organizational environments.

Detailed information about CVE-2022-43464: Hidden Functionality in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616 affecting UNIMO Technology Co., Lt

CVE-2022-43464: Hidden Functionality in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-43464: Hidden Functionality in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616

Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command. The affected products/versions are as follows: WCR-300 firmware Ver. 1.87 and earlier, WHR-HP-G300N firmware Ver. 2.00 and earlier, WHR-HP-GN firmware Ver. 1.87 and earlier, WPL-05G300 firmware Ver. 1.88 and earlier, WZR-300HP firmware Ver. 2.00 and earlier, WZR-450HP firmware Ver. 2.00 and earlier, WZR-600DHP firmware Ver. 2.00 and earlier, WZR-900DHP firmware Ver. 1.15 and earlier, WZR-HP-AG300H firmware Ver. 1.76 and earlier, WZR-HP-G302H firmware Ver. 1.86 and earlier, WLAE-AG300N firmware Ver. 1.86 and earlier, FS-600DHP firmware Ver. 3.40 and earlier, FS-G300N firmware Ver. 3.14 and earlier, FS-HP-G300N firmware Ver. 3.33 and earlier, FS-R600DHP firmware Ver. 3.40 and earlier, BHR-4GRV firmware Ver. 2.00 and earlier, DWR-HP-G300NH firmware Ver. 1.84 and earlier, DWR-PG firmware Ver. 1.83 and earlier, HW-450HP-ZWE firmware Ver. 2.00 and earlier, WER-A54G54 firmware Ver. 1.43 and earlier, WER-AG54 firmware Ver. 1.43 and earlier, WER-AM54G54 firmware Ver. 1.43 and earlier, WER-AMG54 firmware Ver. 1.43 and earlier, WHR-300 firmware Ver. 2.00 and earlier, WHR-300HP firmware Ver. 2.00 and earlier, WHR-AM54G54 firmware Ver. 1.43 and earlier, WHR-AMG54 firmware Ver. 1.43 and earlier, WHR-AMPG firmware Ver. 1.52 and earlier, WHR-G firmware Ver. 1.49 and earlier, WHR-G300N firmware Ver. 1.65 and earlier, WHR-G301N firmware Ver. 1.87 and earlier, WHR-G54S firmware Ver. 1.43 and earlier, WHR-G54S-NI firmware Ver. 1.24 and earlier, WHR-HP-AMPG firmware Ver. 1.43 and earlier, WHR-HP-G firmware Ver. 1.49 and earlier, WHR-HP-G54 firmware Ver. 1.43 and earlier, WLI-H4-D600 firmware Ver. 1.88 and earlier, WLI-TX4-AG300N firmware Ver. 1.53 and earlier, WS024BF firmware Ver. 1.60 and earlier, WS024BF-NW firmware Ver. 1.60 and earlier, WZR2-G108 firmware Ver. 1.33 and earlier, WZR2-G300N firmware Ver. 1.55 and earlier, WZR-450HP-CWT firmware Ver. 2.00 and earlier, WZR-450HP-UB firmware Ver. 2.00 and earlier, WZR-600DHP2 firmware Ver. 1.15 and earlier, WZR-AGL300NH firmware Ver. 1.55 and earlier, WZR-AMPG144NH firmware Ver. 1.49 and earlier, WZR-AMPG300NH firmware Ver. 1.51 and earlier, WZR-D1100H firmware Ver. 2.00 and earlier, WZR-G144N firmware Ver. 1.48 and earlier, WZR-G144NH firmware Ver. 1.48 and earlier, WZR-HP-G300NH firmware Ver. 1.84 and earlier, WZR-HP-G301NH firmware Ver. 1.84 and earlier, and WZR-HP-G450H firmware Ver. 1.90 and earlier.

CVE-2022-39044 is a vulnerability identified in multiple Buffalo network devices, affecting a broad range of models and firmware versions. The core issue is a hidden functionality within the firmware that allows a network-adjacent attacker, who already possesses administrative privileges, to execute arbitrary operating system commands on the affected device. This vulnerability is present in numerous Buffalo routers and wireless access points, spanning many firmware versions up to late 2022. The attack vector requires the attacker to be network-adjacent, meaning they must have access to the same local network or a connected network segment. Importantly, the attacker must already have administrative privileges on the device, which implies prior compromise or credential theft. The vulnerability does not require user interaction and affects confidentiality, integrity, and availability of the device, as arbitrary OS command execution can lead to full device compromise, data leakage, manipulation of network traffic, or denial of service. The CVSS v3.1 base score is 6.8, categorized as medium severity, reflecting the requirement for high privileges but the high impact of exploitation. No known exploits in the wild have been reported to date. The vulnerability affects a wide range of Buffalo network devices, including but not limited to models such as WCR-300, WHR-HP-G300N, WZR-450HP, FS-600DHP, BHR-4GRV, and many others with firmware versions up to specified limits. This broad product impact suggests a systemic issue in Buffalo's firmware design or codebase related to hidden functionality that can be triggered by privileged users to execute OS commands.

Detailed information about CVE-2022-39044: Hidden Functionality in BUFFALO INC. Buffalo network devices affecting BUFFALO INC. Buffalo network devices. Get real

Title	Severity	Type	Source	Date

Threats Tagged 'hidden-functionality'

Filter Threats

Threats Tagged 'hidden-functionality'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility