The vulnerability is an excessive file permissions flaw in the Buffalo TeraStation NAS TS5400R firmware. It permits authenticated users to upload and execute a PHP file via the web interface, which in turn enables them to read the /etc/shadow file. This disclosure can reveal hashed passwords for all configured accounts, including root, thereby compromising the confidentiality of the system's credentials. The weakness is classified as CWE‑732.

Affected products are Buffalo TeraStation NAS TS5400R running firmware 4.02‑0.06 or earlier. Only these versions contain the stored permission flaw; newer firmware revisions are presumed fixed (though not listed explicitly).

The CVSS score for this vulnerability is 6.9, indicating medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the device’s web interface, though the web server is reachable from the local network. Once authenticated, an attacker can upload a malicious PHP script, trigger it, and read /etc/shadow without additional privileges. The moderate CVSS score, absence of a public exploit, and the need for valid credentials suggest that while the risk is significant for insiders or compromised local users, the broader threat surface is limited.