# CVE-2026-29516: Buffalo TeraStation NAS TS5400R excessive file permissions in /etc/shadow

Source: https://junglewise.ai/threats/cve-2026-29516-buffalo-terastation-nas-ts5400r-excessive-file-permissions-in-etc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-16. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-29516 · Severity: medium · CVSS 4.9 · Published 2026-03-16

Buffalo TeraStation TS5400R storage devices contain a security flaw where sensitive system files have incorrect access permissions. An authorized user with high-level privileges can exploit this to access the device's password file, potentially allowing them to retrieve hashed passwords for all accounts, including the administrator (root). This could lead to full system compromise if the passwords are successfully decrypted.

Vendors: [Buffalo](https://junglewise.ai/threats/vendors/buffalo).

## Quick answers

**Is CVE-2026-29516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29516 being exploited in the wild.

**How severe is CVE-2026-29516?** Medium severity, with a CVSS score of 4.9, published 16 March 2026.

**Which products and versions are affected?** Buffalo TeraStation TS5400R firmware 4.02-0.06 and prior.

**Is there a fix for CVE-2026-29516?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-29516 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-29516?** Check whether you run Buffalo TeraStation TS5400R firmware, Buffaloamericas Terastation Nas Ts5400r or Buffaloamericas Terastation Nas Ts5400r Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect permission assignment (CWE-732) in Buffalo TeraStation NAS TS5400R firmware (v4.02-0.06 and prior) results in the /etc/shadow file being world-readable. An authenticated attacker with high privileges can exploit this by uploading and executing a PHP file via the webserver to read the file contents. This allows the attacker to retrieve hashed passwords for all configured system accounts, including root. The product has reportedly reached end-of-life (EOL) status, and no official patch is currently noted.

## Affected products

- Buffalo TeraStation NAS TS5400R firmware 4.02-0.06 and prior

## Timeline

- 2026-03-16: disclosed: Initial disclosure by VulnCheck
- 2026-03-16: advisory

## References

- [https://buffaloamericas.com/](https://buffaloamericas.com/)
- [https://www.vulncheck.com/advisories/buffalo-terastation-ts5400r-excessive-file-permissions-information-disclosure](https://www.vulncheck.com/advisories/buffalo-terastation-ts5400r-excessive-file-permissions-information-disclosure)