CVE-2022-43466: Buffalo Wex-1800ax4 Firmware

Medium severity, CVSS 6.8. EPSS: 0.8% chance of exploitation in the next 30 days.

OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command if a specially crafted request is sent to a specific CGI program.

Affected products

• Buffalo Wex-1800ax4 Firmware: up to and including 1.13
• Buffalo Wex-1800ax4ea Firmware: up to and including 1.13
• Buffalo Wsr-2533dhp2 Firmware: up to and including 1.22
• Buffalo Wsr-2533dhp3 Firmware: up to and including 1.26
• Buffalo Wsr-2533dhpl2 Firmware: up to and including 1.03
• Buffalo Wsr-2533dhpls Firmware: up to and including 1.07
• Buffalo Wsr-3200ax4b Firmware: version 1.25 only
• Buffalo Wsr-3200ax4s Firmware: up to and including 1.26
• Buffalo Wsr-a2533dhp2 Firmware: up to and including 1.22
• Buffalo Wsr-a2533dhp3 Firmware: up to and including 1.26

Published 2022-12-19. Last modified 2026-06-17.