|
[Japanese]
|
JVNDB-2025-000103
|
Use of password hash with insufficient computational effort vulnerability in BUFFALO Wi-Fi router "WSR-1800AX4 series"
|
|
Wi-Fi router "WSR-1800AX4 series" provided by BUFFALO INC. contains the following vulnerability.
* Use of password hash with insufficient computational effort (CWE-916) - CVE-2025-46413
Kazuaki Chikamori and Takayuki Tatekawa of National Institute of Technology, Kochi College reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 4.3 (Medium) [IPA Score]
- Attack Vector: Adjacent Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
|
|
|
BUFFALO INC.
- WSR-1800AX4 firmware versions prior to Ver.1.09
- WSR-1800AX4-KH firmware versions prior to Ver.1.19
- WSR-1800AX4B firmware versions prior to Ver.1.11
- WSR-1800AX4S firmware versions prior to Ver.1.11
|
WSR-1800AX4P is not affected by this vulnerability.
This vulnerability affected when WPS is enabled.
|
|
PIN code and/or Wi-Fi password may be obtained by an attacker.
|
|
[Update the firmware]
Apply the appropriate firmware update according to the information provided by the developer.
The developer has released the following firmware updates to address this vulnerability.
* WSR-1800AX4 firmware Ver.1.09
* WSR-1800AX4S firmware Ver.1.11
* WSR-1800AX4B firmware Ver.1.11
* WSR-1800AX4-KH firmware Ver.1.19
|
|
BUFFALO INC.
|
|
- No Mapping(CWE-Other) [IPA Evaluation]
|
|
- CVE-2025-46413
|
|
- JVN : JVN#13754005
|
|
- [2025/11/07]
Web page was published
|
