CVE-2023-24544 in BS-GSL2024
Summary
by MITRE • 04/11/2023
Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. As a result, the product settings may be altered. The affected products and versions are as follows: BS-GSL2024 firmware Ver. 1.10-0.03 and earlier, BS-GSL2016P firmware Ver. 1.10-0.03 and earlier, BS-GSL2016 firmware Ver. 1.10-0.03 and earlier, BS-GS2008 firmware Ver. 1.0.10.01 and earlier, BS-GS2016 firmware Ver. 1.0.10.01 and earlier, BS-GS2024 firmware Ver. 1.0.10.01 and earlier, BS-GS2048 firmware Ver. 1.0.10.01 and earlier, BS-GS2008P firmware Ver. 1.0.10.01 and earlier, BS-GS2016P firmware Ver. 1.0.10.01 and earlier, and BS-GS2024P firmware Ver. 1.0.10.01 and earlier
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2025
This vulnerability represents a critical improper access control flaw classified under cwe-284 which affects multiple Buffalo network devices including various models of gsl and gs series switches and routers. The weakness stems from insufficient authorization checks within the device's web interface and file access mechanisms, allowing attackers who can reach the device through network adjacency to bypass normal access controls and retrieve sensitive configuration files. The vulnerability specifically impacts firmware versions up to and including the mentioned release numbers, indicating a widespread issue affecting the entire product line's software implementations.
The technical nature of this flaw enables a network-adjacent attacker to exploit the device's file system access controls without proper authentication or authorization validation. This misconfiguration allows the attacker to directly access and download specific system files that contain critical device configuration data, user credentials, and potentially sensitive network parameters. The vulnerability exists in the device's web server implementation where file access paths are not properly validated, creating a direct attack vector that bypasses normal security boundaries. This weakness is particularly concerning as it allows for both information disclosure and potential configuration modification attacks.
Operational impact of this vulnerability extends beyond simple information disclosure to include potential system compromise and network disruption. An attacker with network adjacency can obtain device settings which may reveal internal network topology, administrative credentials, and other sensitive configuration parameters that could be used for further attacks within the network. The ability to alter product settings through this vulnerability means that attackers could potentially modify device configurations to redirect traffic, disable security features, or create backdoors for persistent access. This vulnerability directly impacts the confidentiality, integrity, and availability of the affected network infrastructure.
Mitigation strategies should focus on immediate firmware updates to the latest available versions which contain proper access control implementations and authentication checks. Network segmentation and access control measures should be implemented to limit network adjacency access to these devices, ensuring that only authorized network segments can reach the affected hardware. Regular security audits should be conducted to verify that proper access controls are in place and that no unauthorized access paths exist. Additionally, network monitoring should be enhanced to detect unusual file access patterns or configuration changes that might indicate exploitation attempts. Organizations should also implement principle of least privilege access controls for administrative interfaces and consider disabling unnecessary web management interfaces when not required for operations. The vulnerability demonstrates the importance of proper input validation and access control implementation as outlined in nist cybersecurity framework and aligns with attack techniques documented in mitre att&ck matrix under privilege escalation and credential access categories.