CVE-2017-10896

Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

• CWE-79

• http://buffalo.jp/support_s/s20171201.htmlPatch, Vendor Advisory
• https://jvn.jp/en/jp/JVN65994435/index.htmlThird Party Advisory, VDB Entry
• http://buffalo.jp/support_s/s20171201.htmlPatch, Vendor Advisory
• https://jvn.jp/en/jp/JVN65994435/index.htmlThird Party Advisory, VDB Entry

Published

Dec 8, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10890Session management issue in RX-V200 firmware versions prior …
• CVE-2017-10891Untrusted search path vulnerability in Media Go version 3.2.…
• CVE-2017-10892Untrusted search path vulnerability in Music Center for PC v…
• CVE-2017-10893Untrusted search path vulnerability in The Public Certificat…
• CVE-2017-10894StreamRelay.NET.exe ver2.14.0.7 and earlier allows remote at…
• CVE-2017-10895sDNSProxy.exe ver1.1.0.0 and earlier allows remote attackers…
• CVE-2017-10897Input validation issue in Buffalo BBR-4HG and and BBR-4MG br…
• CVE-2017-10898SQL injection vulnerability in the A-Member and A-Member for…
• CVE-2017-10899SQL injection vulnerability in the A-Reserve and A-Reserve f…
• CVE-2017-1090Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-10900PTW-WMS1 firmware version 2.000.012 allows remote attackers …
• CVE-2017-10901Buffer overflow in PTW-WMS1 firmware version 2.000.012 allow…