CVE-2026-33280

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-912

Description

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.

Affected products

Buffalo Fs-M1266 Firmware: before 4.13 — fixed in 4.13
Buffalo Fs-S1266 Firmware: before 4.13 — fixed in 4.13
Buffalo Vr-U300W Firmware: before 1.42 — fixed in 1.42
Buffalo Vr-U500X Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-1266R Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-1266Wdpr Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-1266Wdpra Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-1750D Firmware: before 1.07 — fixed in 1.07
Buffalo Wapm-2133R Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-2133Tr Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-Ax4R Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-Ax8R Firmware: before 1.42 — fixed in 1.42
Buffalo Wapm-Axetr Firmware: before 1.42 — fixed in 1.42
Buffalo Waps-1266 Firmware: before 1.42 — fixed in 1.42
Buffalo Waps-Ax4 Firmware: before 1.42 — fixed in 1.42
Buffalo Wcr-1166Dhpl Firmware: before 1.01 — fixed in 1.01
Buffalo Wem-1266 Firmware: before 2.87 — fixed in 2.87
Buffalo Wem-1266Wp Firmware: before 2.87 — fixed in 2.87
Buffalo Wrm-D2133Hp Firmware: before 3.01 — fixed in 3.01
Buffalo Wrm-D2133Hs Firmware: before 3.01 — fixed in 3.01
Buffalo Wsr3600Be4-Kh Firmware: before 6.02 — fixed in 6.02
Buffalo Wsr3600Be4P Firmware: before 5.02 — fixed in 5.02
Buffalo Wtr-M2133Hp Firmware: before 3.01 — fixed in 3.01
Buffalo Wtr-M2133Hs Firmware: before 3.01 — fixed in 3.01
Buffalo Wxr-1750Dhp2 Firmware: before 2.63 — fixed in 2.63
Buffalo Wxr-1750Dhp Firmware: before 2.63 — fixed in 2.63
BUFFALO INC. WXR-1900DHP2: before 2.62 — fixed in 2.62
Buffalo Wxr-1900Dhp3 Firmware: before 2.66 — fixed in 2.66
Buffalo Wxr-1900Dhp Firmware: before 2.53 — fixed in 2.53
Buffalo Wxr-5950Ax12 Firmware: before 3.57 — fixed in 3.57

How to fix

Upgrade to a fixed version: Buffalo Fs-M1266 Firmware 4.13; Buffalo Fs-S1266 Firmware 4.13; Buffalo Vr-U300W Firmware 1.42; Buffalo Vr-U500X Firmware 1.42; Buffalo Wapm-1266R Firmware 1.42; Buffalo Wapm-1266Wdpr Firmware 1.42; Buffalo Wapm-1266Wdpra Firmware 1.42; Buffalo Wapm-1750D Firmware 1.07; Buffalo Wapm-2133R Firmware 1.42; Buffalo Wapm-2133Tr Firmware 1.42; Buffalo Wapm-Ax4R Firmware 1.42; Buffalo Wapm-Ax8R Firmware 1.42. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33280 or the next vulnerability affects your stack