A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles by modifying a parameter within requests to the /nasapi endpoint. This permits an attacker to discover account identifiers and the levels of access granted to each, an information disclosure that could aid in social engineering, credential guessing, or the planning of more targeted attacks. The weakness is a classic information exposure defect, analogous to CWE‑200.

The affected product is the Buffalo Link Station running firmware 1.85‑0.01. No other vendors or versions are listed, and the vulnerability is identified only for this specific firmware release.

The lack of authentication requirements for the vulnerable API means any network participant with access to the device can trigger the enumeration. Although no public exploit or CVSS score is currently available and the vulnerability is not listed in the CISA KEV catalog, the potential for attackers to gather privilege information remains significant. Attackers could use the listed usernames and role information in subsequent attacks, such as phishing or privileged account credential reuse. The exploitability is low to moderate from a technical standpoint, but the impact of the disclosed information is high enough to warrant mitigation.