CVE-2023-51073 is a high severity (CVSS 8.1) flaw in Buffalo LS210D firmware 1.78-0.03, where the firmware update script update_notifications.sh lets a remote attacker execute arbitrary code. The record names no fix, so check Buffalo for newer firmware and keep the NAS off untrusted networks.
What's affected
The NVD description says an issue in Buffalo LS210D v1.78-0.03 allows a remote attacker to execute arbitrary code via the firmware update script at /etc/init.d/update_notifications.sh. The references are a researcher repository on GitHub and the vendor's home page.
The record lists no CWE and names no fixed firmware. I did not load the references, so I cannot say whether Buffalo has issued a fix. Check the vendor's support pages for your model.
CVSS for this entry is 8.1 (High) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Open the NAS administration page and read the firmware version. Version 1.78-0.03 matches the record.
The vector uses network access with high attack complexity, so the attacker needs a favorable position, for example on the path between the device and the update source. Ask whether the NAS is reachable from outside your network or can be reached through port forwarding.
What to do now
- Find all Buffalo LS210D devices and confirm their firmware.
- Check Buffalo's support site for a firmware newer than 1.78-0.03.
- Disable remote access and port forwarding to the NAS, and keep it on a trusted segment.
- Turn off the firmware notification feature if your model allows it, and back up important data.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
The record lists no CWE for this entry, so the class of weakness is described only by the vendor or researcher text in the sources below.
The record offers no CWE, so the class is only described as arbitrary code execution through an update script. Update mechanisms are sensitive because they run with high privilege and fetch content over the network. When the script handles remote input unsafely, the attacker inherits that privilege.
The score is held below critical by the high attack complexity. NAS devices often store backups, which raises the stakes if one is taken over.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Why is attack complexity high?
The vector indicates the attacker needs conditions outside their control, though the record does not spell them out.
Is a patch available?
The record does not say. Check Buffalo.
Sources
Last reviewed: 19 October 2026.
