CVE-2026-32678
High
Description
Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.
SeverityHigh
CVSS8.7
Exploit probability—
ProductBuffalo Wzr-s900dhp Firmware
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-288CWE-288
How to fix
Update
- buffalo wcr-1166dhpl_firmware1.01 or later
- buffalo wsr3600be4-kh_firmware6.02 or later
- buffalo wsr3600be4p_firmware5.02 or later
- buffalo wxr-1750dhp_firmware2.63 or later
- buffalo wxr-1750dhp2_firmware2.63 or later
- buffalo wxr18000be10p_firmware5.03 or later
- buffalo wxr-1900dhp_firmware2.53 or later
- buffalo wxr-1900dhp2_firmware2.62 or later
- buffalo wxr-1900dhp3_firmware2.66 or later
- buffalo wxr-5950ax12_firmware3.57 or later
- buffalo wxr-6000ax12b_firmware3.57 or later
- buffalo wxr-6000ax12p_firmware3.57 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buffalo wzr-s900dhp_firmware | No range specified | — |
| buffalo wcr-1166dhpl_firmware | v < 1.01 | 1.01 |
| buffalo wsr3600be4-kh_firmware | v < 6.02 | 6.02 |
| buffalo wsr3600be4p_firmware | v < 5.02 | 5.02 |
| buffalo wxr-1750dhp_firmware | v < 2.63 | 2.63 |
| buffalo wxr-1750dhp2_firmware | v < 2.63 | 2.63 |
| buffalo wxr18000be10p_firmware | v < 5.03 | 5.03 |
| buffalo wxr-1900dhp_firmware | v < 2.53 | 2.53 |
| buffalo wxr-1900dhp2_firmware | v < 2.62 | 2.62 |
| buffalo wxr-1900dhp3_firmware | v < 2.66 | 2.66 |
| buffalo wxr-5950ax12_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12b_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12p_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12s_firmware | v < 3.57 | 3.57 |
| buffalo wzr-1166dhp_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1166dhp2_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1750dhp_firmware | v < 2.32 | 2.32 |
| buffalo wzr-1750dhp2_firmware | v < 2.33 | 2.33 |
| buffalo wzr-s1750dhp_firmware | v < 2.34 | 2.34 |
| buffalo wrm-d2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wrm-d2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wem-1266_firmware | v < 2.87 | 2.87 |
| buffalo wem-1266wp_firmware | v < 2.87 | 2.87 |
| buffalo vr-u300w_firmware | v < 1.42 | 1.42 |
| buffalo vr-u500x_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpra_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1750d_firmware | v < 1.07 | 1.07 |
| buffalo wapm-2133r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-2133tr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax4r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax8r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-axetr_firmware | v < 1.42 | 1.42 |
| buffalo waps-1266_firmware | v < 1.42 | 1.42 |
| buffalo waps-ax4_firmware | v < 1.42 | 1.42 |
| buffalo fs-m1266_firmware | v < 4.13 | 4.13 |
| buffalo fs-s1266_firmware | v < 4.13 | 4.13 |
| buffalo wzr-600dhp_firmware | No range specified | — |
| buffalo wzr-600dhp2_firmware | No range specified | — |
| buffalo wzr-600dhp3_firmware | No range specified | — |
| buffalo wzr-900dhp_firmware | No range specified | — |
| buffalo wzr-900dhp2_firmware | No range specified | — |
| buffalo wzr-s600dhp_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.