A stack-based buffer overflow vulnerability exists in BUFFALO INC. WSR-300HP Wi-Fi products. This flaw can be triggered by a crafted HTTP request without authentication, potentially causing a denial-of-service (DoS) condition. The vulnerability has a high severity rating with a CVSS score of 7.5. No information about available patches or vendor advisories is provided.
CVE-2026-86530 is an OS command injection vulnerability in BUFFALO INC.'s WSR-300HP Wi-Fi product. The vulnerability arises from improper handling of web form input used to assemble command line strings internally. An administrative user can exploit this flaw by sending a crafted HTTP request to execute arbitrary operating system commands. The vulnerability has a high severity rating with a CVSS score of 7.2.
CVE-2026-33366 is a medium severity vulnerability in BUFFALO Wi-Fi router products where a critical function lacks authentication. This flaw allows an unauthenticated attacker to forcibly reboot the affected router devices. The vulnerability does not impact confidentiality or integrity but affects availability by enabling denial of service through forced reboots. No known exploits are reported in the wild. There is no information about patches or vendor advisories at this time.
A hidden functionality vulnerability exists in BUFFALO Wi-Fi router products that may allow attackers with high privileges to access debugging features and execute arbitrary operating system commands. This vulnerability has a high severity score of 7.2 and affects certain versions of BUFFALO Wi-Fi routers. No official patch or remediation information is currently provided. There are no known exploits in the wild at this time.
CVE-2026-32678 is an authentication bypass vulnerability in BUFFALO Wi-Fi router products. This flaw allows an attacker to alter critical configuration settings without needing to authenticate. The vulnerability has a high severity rating with a CVSS score of 7.5. No known exploits are reported in the wild, and no patch or official remediation information is provided in the available data. The issue affects certain versions of BUFFALO Wi-Fi routers as referenced in external sources. Due to the lack of vendor advisory or patch information, the current remediation status is unclear.
A code injection vulnerability (CVE-2026-32669) exists in BUFFALO Wi-Fi router products that could allow an attacker to execute arbitrary code on affected devices. The vulnerability has a high severity with a CVSS score of 8.8, indicating it is exploitable remotely without privileges but requires user interaction. No official patch or remediation information is currently provided. There are no known exploits in the wild at this time.
CVE-2026-27650 is an OS Command Injection vulnerability in BUFFALO Wi-Fi router products. Exploitation of this flaw could allow an attacker to execute arbitrary operating system commands on affected devices. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability. No specific patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.
Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacker.
A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrary OS command may be executed via some file alteration.
CVE-2025-61871 is a vulnerability in BUFFALO INC. 's NAS Navigator2 Windows client prior to version 3.12.0, caused by an unquoted service path. This flaw allows a user with write permissions on the root of the system drive to execute arbitrary code with SYSTEM privileges. The vulnerability arises because Windows interprets unquoted service paths containing spaces incorrectly, enabling path hijacking attacks. Exploitation requires local access with elevated privileges but no user interaction. The CVSS score is 6.7 (medium severity), reflecting significant impact on confidentiality, integrity, and availability if exploited. No known exploits are currently reported in the wild.