CVE-2023-24544

Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier

• CWE-284

• https://jvn.jp/en/vu/JVNVU96824262/Third Party Advisory
• https://www.buffalo.jp/news/detail/20230310-01.htmlPatch, Vendor Advisory
• https://jvn.jp/en/vu/JVNVU96824262/Third Party Advisory
• https://www.buffalo.jp/news/detail/20230310-01.htmlPatch, Vendor Advisory

Published

Apr 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24537Calling any of the Parse functions on Go source code which c…7.5
• CVE-2023-24538Templates do not properly consider backticks (`) as Javascri…9.8
• CVE-2023-24539Angle brackets (<>) are not considered dangerous characters …7.3
• CVE-2023-2454schema_element defeats protective search_path changes; It wa…7.2
• CVE-2023-24540Not all valid JavaScript whitespace characters are considere…9.8
• CVE-2023-24542Unquoted search path or element in some Intel(R) Thunderbolt…6.7
• CVE-2023-24545On affected platforms running Arista CloudEOS an issue in th…7.5
• CVE-2023-24546On affected versions of the CloudVision Portal improper acce…8.1
• CVE-2023-24547On affected platforms running Arista MOS, the configuration …6.5
• CVE-2023-24548On affected platforms running Arista EOS with VXLAN configur…6.5
• CVE-2023-24549A vulnerability has been identified in Solid Edge SE2022 (Al…7.8
• CVE-2023-2455Row security policies disregard user ID changes after inlini…5.4