CVE-2026-29516

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29516
Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior contain an excessive file permissions vulnerability that allows authenticated attackers to read the /etc/shadow file by uploading and executing a PHP file through the webserver. Attackers can exploit world-readable permissions on /etc/shadow to retrieve hashed passwords for all configured accounts including root.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://buffaloamericas.com/ Product
https://www.vulncheck.com/advisories/buffalo-terastation-ts5400r-excessive-file-permissions-information-disclosure Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:buffaloamericas:terastation_nas_ts5400r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:buffaloamericas:terastation_nas_ts5400r:-:*:*:*:*:*:*:*
History

14 May 2026, 20:23

Type Values Removed Values Added
References () https://buffaloamericas.com/ - () https://buffaloamericas.com/ - Product
References () https://www.vulncheck.com/advisories/buffalo-terastation-ts5400r-excessive-file-permissions-information-disclosure - () https://www.vulncheck.com/advisories/buffalo-terastation-ts5400r-excessive-file-permissions-information-disclosure - Third Party Advisory
Summary
  • (es) La versión de firmware 4.02-0.06 y anteriores de Buffalo TeraStation NAS TS5400R contienen una vulnerabilidad de permisos de archivo excesivos que permite a atacantes autenticados leer el archivo / etc / shadow al cargar y ejecutar un archivo PHP a través del servidor web. Los atacantes pueden explotar los permisos de lectura global en / etc / shadow para recuperar contraseñas con hash para todas las cuentas configuradas, incluyendo root.
CPE cpe:2.3:o:buffaloamericas:terastation_nas_ts5400r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:buffaloamericas:terastation_nas_ts5400r:-:*:*:*:*:*:*:*
First Time Buffaloamericas terastation Nas Ts5400r Firmware
Buffaloamericas terastation Nas Ts5400r
Buffaloamericas

17 Mar 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9

16 Mar 2026, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 20:16

Updated : 2026-05-14 20:23

NVD link : CVE-2026-29516

Mitre link : CVE-2026-29516

CVE.ORG link : CVE-2026-29516

JSON object : View

Products Affected

buffaloamericas

  • terastation_nas_ts5400r
  • terastation_nas_ts5400r_firmware
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource