CVE-2016-7826

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to read arbitrary files via specially crafted POST requests.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
BUFFALO INC.	WNC01WH	firmware version 1.0.0.8 and earlier

References

http://buffalo.jp/support_s/s20161201.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/94648Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN40613060/index.htmlThird Party Advisory, VDB Entry
http://buffalo.jp/support_s/s20161201.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/bid/94648Third Party Advisory, VDB Entry
https://jvn.jp/en/jp/JVN40613060/index.htmlThird Party Advisory, VDB Entry

Timeline

Published: Jun 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-78308.8Sony PCS-XG100, PCS-XG100S, PCS-XG100C, PCS-XG77, PCS-XG77S, PCS-XG77C devices with firmware versions prior to Ver.1.51 and PCS-XC1 devices CVE-2016-78316.1Sleipnir 4 Black Edition for Mac 4.5.3 and earlier and Sleipnir 4 for Mac 4.5.3 and earlier (Mac App Store) may allow a remote attacker to s CVE-2016-78325.3Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to obtain an arbitrary DBM (Cybozu Dezie proprietary forma CVE-2016-78337.5Cybozu Dezie 8.0.0 to 8.1.1 allows remote attackers to bypass access restrictions to delete an arbitrary DBM (Cybozu Dezie proprietary forma CVE-2016-78348.8SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, S CVE-2016-78359.1Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and CVE-2016-78369.8SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with CVE-2016-78377.8Buffer overflow in BlueZ 5.41 and earlier allows an attacker to execute arbitrary code via the parse_line function used in some userland uti CVE-2016-78387.8Untrusted search path vulnerability in WinSparkle versions prior to 0.5.3 allows remote attackers to execute arbitrary code via a specially CVE-2016-78396.1Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter.CVE-2016-78406.1Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter.CVE-2016-78416.1Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter.