Security Notices

 

WPA2-Vulnerability (For Wireless Routers, USB adapters)

Buffalo Inc. is aware of the recently publicized security exploit “KRACKs”.

Since this vulnerability depends on the client function of the WPA 2 standard, it affects wireless USB adapters and bridge mode (WB · WDS, etc.) of wireless routers that support WPA 2.

Buffalo is investigating its product line to determine which products may be affected by this vulnerability. As the investigation progresses, Buffalo will update this public release with information about affected products.

Current Products(EU)

Category

Product Series

Note

Wireless Router

WZR-900DHP Series

 

We will release the fixed firmware soon. Please update the firmware as soon as it is released.

 

 

WBMR-300HPD Series

 Discontinued products(EU)

Category

Product Series

Note

Wireless Router

WZR-1750DHP Series

We will release the fixed firmware soon. Please update the firmware as soon as it is released.

 

WZR-600DHP2 Series

WZR-HP-AG300H Series

WZR-HP-G450H Series

WZR-HP-G300NH Series

WZR-HP-G300NH2 Series

WHR-300HP2 Series

WHR-600D Series

Wireless

USB

Adapter

WLI-UC-G300HP Series

We will release the fixed driver soon. Please update the driver as soon as it is released.

WLI-UC-GNM Series

WLI-TX4-AG300N Series

WI-U2-300D Series

 

  If you are not using the bridge mode (WB · WDS etc.) with the wireless router, it is not affected, so you can use it safely as it is.

Please confirm the following points as to whether or not to use the bridge mode.(The confirmation method differs for some products, please refer to the explanation about the bridge mode of each product manual.)

*If you set the unit rear switch to "AUTO" at the time of product setting, the bridge mode is not enabled.

*If you set the unit rear switch to "MANUAL" at the time of product setting, and "ROUTER" or "AP" is selected with the switch, the bridge mode is not enabled.

*If you set the unit rear switch to "MANUAL" at the time of product setting, and "WB" is selected with the switch, the bridge mode is enabled.

Products confirmed Not Affected

Current Products

Category

Product Series

Note

Wireless

Access Point

WAPM Series

Even if you use these products as a repeater (WDS enabled

), you can safely use it as it is.

WAPS Series

Discontinued Products

Category

Product Series

Note

Wireless Router

WMR-300/300S Series

Even if you use these products with bridge mode, you can safely use it as it is.

Workarounds

As soon as the affected products are clarified, we will release the firmware that will be fixed vulnerability.

Buffalo strongly recommends that you download the latest firmware as soon as possible after fixed firmware is available.


 

Samba vulnerability

Description of vulnerability:

There is a vulnerability reported as CVE-2017-7494 regarding security in Samba version 3.5.0 or later. 

With this vulnerability, malicious clients may execute illegal code by copying illegal shared libraries to writable shared folders.

Products

Product category Product series
TeraStation TS 5010 series (fixed)
TS 3010 series (fixed)
TS 7000 series (fixed)
TS 5000 series (fixed)
TS 5200DS series (fixed)
TS 3000 series (fixed)
TS 1000 series (fixed)
TS-X series (fixed)
TS-V series (fixed)
Product category Product series
LinkStation
LS 500 series (fixed)
LS 420DS serie (fixed)
LS 400 series (fixed)
LS 200 series (fixed)
LS-WSXL / R1 Series (fixed)
LS-X series (fixed)

LS-V series (fixed)

Product category Product series UserFriendly Professional
AirStation WZR-HP-AG300H   19154d (fixed)
WZR-HP-G300NH2 19154d (fixed)
WZR-HP-G450H 20025d (fixed)
WZR-600DHP2 n/a



※ Windows Storage Server model of TeraStation are not affected by this issue. 

 * Please check this page for latest updates. 

 The threat posed by vulnerability 

 The configuration can be altered or malicious programs may be executed. 

 Workaround 

 As the target products are identified, we will release firmware that will take measures against the vulnerability of that product. 

 Please take the following precaution until the firmware is corrected. 

• When sharing folders with the Samba protocol, please grant write permission only to trusted users.