CVE-2025-26167
Published: 06 March 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2025-26167 is an arbitrary file read vulnerability affecting the Buffalo LS520D NAS device running firmware version 4.53. The flaw resides in the NAS web UI, enabling attackers to access and read arbitrary internal files without authentication.
Unauthenticated attackers with network access can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation allows reading of sensitive internal files, resulting in high confidentiality impact but no integrity or availability disruption, as reflected in its CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and mapping to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Advisories detailing the issue, including potential mitigations, are available from SpikeReply at https://github.com/SpikeReply/advisories/blob/0f15f5aefb959fbaff049da7cc3e36733e25b580/cve/buffalo/cve-2025-26167.md. The CVE was published on 2025-03-06.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Arbitrary unauthenticated file read in public-facing NAS web UI directly enables exploitation of public-facing applications (T1190) and collection of sensitive data from the local system (T1005).