CVE-2026-29516

Name of the Vulnerable Software and Affected Versions Buffalo TeraStation NAS TS5400R versions 4.02-0.06 and earlier

Description An excessive file permissions issue exists in Buffalo TeraStation NAS TS5400R. Authenticated attackers can read the /etc/shadow file by uploading and executing a PHP file through the webserver. Exploiting world-readable permissions on /etc/shadow allows retrieval of hashed passwords for all configured accounts, including the root account. The /etc/shadow file contains sensitive password information. The affected API endpoint is the webserver used for file uploads. The vulnerable parameter is the uploaded PHP file.

Recommendations Versions prior to 4.02-0.06 should be updated.