BUFFALO INC.
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| BUFFALO Wi-Fi router products | 5 | – | Mar 27, 2026 |
| WSR-A2533DHP2 | 5 | – | Apr 15, 2024 |
| WSR-2533DHP2 | 5 | – | Apr 15, 2024 |
| WSR-2533DHP | 4 | – | Apr 15, 2024 |
| Buffalo network devices | 4 | – | Dec 7, 2022 |
| WSR-2533DHPL | 4 | – | Apr 15, 2024 |
| VR-S1000 | 4 | – | Dec 26, 2023 |
| WSR-2533DHPL2 | 3 | – | Dec 19, 2022 |
| WSR-2533DHP3 | 3 | – | Dec 19, 2022 |
| WSR-2533DHPLB | 3 | – | Dec 19, 2022 |
| WSR-2533DHPLS | 3 | – | Dec 19, 2022 |
| WSR-3200AX4B | 3 | – | Dec 19, 2022 |
| WSR-3200AX4S | 3 | – | Dec 19, 2022 |
| WSR-A2533DHP3 | 3 | – | Dec 19, 2022 |
| WCR-1166DS | 3 | – | Apr 15, 2024 |
| WXR-5700AX7B | 3 | – | Dec 19, 2022 |
| WXR-5700AX7S | 3 | – | Dec 19, 2022 |
| Buffalo broadband routers | 2 | – | Apr 28, 2021 |
| BS-GSL and BS-GS series | 2 | – | Apr 11, 2023 |
| WEX-1800AX4EA | 2 | – | Dec 19, 2022 |
| WEX-1800AX4 | 2 | – | Dec 19, 2022 |
| WHR-G54S | 2 | – | Sep 18, 2020 |
| WEX-G300 | 2 | – | Sep 28, 2026 |
| WSR-1166DHP3 and WSR-1166DHP4 | 2 | – | Jun 9, 2021 |
| WSR-1166DHP2 | 2 | – | Apr 15, 2024 |
| WSR-1166DHP | 2 | – | Apr 15, 2024 |
| WSR-300HP | 2 | – | Sep 28, 2026 |
| WXR9300BE6P series | 1 | – | Oct 15, 2025 |
| NAS Navigator2 (Windows version only) | 1 | – | Oct 10, 2025 |
| WEX-1166DHP | 1 | – | Sep 10, 2024 |
| WEX-1166DHP2 | 1 | – | Sep 10, 2024 |
| WEX-1166DHPS | 1 | – | Sep 10, 2024 |
| WEX-300HPS/N | 1 | – | Sep 10, 2024 |
| WEX-300HPTX/N | 1 | – | Sep 10, 2024 |
| WEX-733DHP | 1 | – | Sep 10, 2024 |
| WEX-733DHP2 | 1 | – | Sep 10, 2024 |
| WEX-733DHPS | 1 | – | Sep 10, 2024 |
| WEX-733DHPTX | 1 | – | Sep 10, 2024 |
| WHR-1166DHP | 1 | – | Sep 10, 2024 |
| WHR-1166DHP2 | 1 | – | Sep 10, 2024 |
| WHR-1166DHP3 | 1 | – | Sep 10, 2024 |
| WHR-1166DHP4 | 1 | – | Sep 10, 2024 |
| WHR-300HP2 | 1 | – | Sep 10, 2024 |
| WHR-600D | 1 | – | Sep 10, 2024 |
| WMR-300 | 1 | – | Sep 10, 2024 |
| WSR-1166DHP3 | 1 | – | Sep 10, 2024 |
| WSR-1800AX4 | 1 | – | Nov 7, 2025 |
| WSR-1800AX4-KH | 1 | – | Nov 7, 2025 |
| WSR-1800AX4B | 1 | – | Nov 7, 2025 |
| WSR-1800AX4S | 1 | – | Nov 7, 2025 |
| WSR-600DHP | 1 | – | Sep 10, 2024 |
| WXR-11000XE12 | 1 | – | Dec 19, 2022 |
| BS-GS series | 1 | – | Apr 11, 2023 |
Exploited and recent CVEs
- CVE-2026-95104 Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition. 0.4%
- CVE-2026-95104 Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition. 0.4%
- CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command. 0.4%
- CVE-2026-86530 BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command. 0.4%
- CVE-2026-33366 Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication. 0.4%
- CVE-2026-33280 Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS comm 0.4%
- CVE-2026-32678 Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication. 0.4%
- CVE-2026-32669 Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products. 0.3%
- CVE-2026-27650 OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products. 0.9%
- CVE-2025-46413 Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacke 0.1%
- CVE-2025-46413 Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacke 0.1%
- CVE-2025-46413 Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacke 0.1%
- CVE-2025-46413 Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. When WPS is enabled, PIN code and/or Wi-Fi password may be obtained by an attacke 0.1%
- CVE-2025-61941 A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrar 0.5%
- CVE-2025-61871 NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary 0.2%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%
- CVE-2024-44072 OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. If a user logs in to the management page and sends a specially crafted request to the affected pro 0.6%