CVE-2023-51073
Published: 11 January 2024
Summary
CVE-2023-51073 is a high-severity an unspecified weakness vulnerability in Buffalo Ls210D Firmware. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-51073 is an unauthenticated remote code execution vulnerability in the Buffalo LS210D network-attached storage device running firmware version 1.78-0.03. The flaw resides in the firmware update notification script located at /etc/init.d/update_notifications.sh, which can be abused to execute attacker-supplied commands.
A remote attacker can exploit the issue over the network without credentials or user interaction. Successful exploitation grants the ability to run arbitrary code, resulting in full compromise of confidentiality, integrity, and availability on the affected device.
The current EPSS score of 0.26 indicates moderate and sustained exploitation interest since disclosure. Public references point to a detailed proof-of-concept on GitHub and vendor information hosted at buffalotech.com, though no official patch or mitigation guidance is described in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55800
Vulnerability details
An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/update_notifications.sh.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.