CVE-2026-33280
Critical
Description
Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.
SeverityCritical
CVSS9.8
Exploit probability—
ProductBuffalo Wcr-1166dhpl Firmware
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-912CWE-912
How to fix
Update
- buffalo wcr-1166dhpl_firmware1.01 or later
- buffalo wsr3600be4-kh_firmware6.02 or later
- buffalo wsr3600be4p_firmware5.02 or later
- buffalo wxr-1750dhp_firmware2.63 or later
- buffalo wxr-1750dhp2_firmware2.63 or later
- buffalo wxr18000be10p_firmware5.03 or later
- buffalo wxr-1900dhp_firmware2.53 or later
- buffalo wxr-1900dhp2_firmware2.62 or later
- buffalo wxr-1900dhp3_firmware2.66 or later
- buffalo wxr-5950ax12_firmware3.57 or later
- buffalo wxr-6000ax12b_firmware3.57 or later
- buffalo wxr-6000ax12p_firmware3.57 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buffalo wcr-1166dhpl_firmware | v < 1.01 | 1.01 |
| buffalo wsr3600be4-kh_firmware | v < 6.02 | 6.02 |
| buffalo wsr3600be4p_firmware | v < 5.02 | 5.02 |
| buffalo wxr-1750dhp_firmware | v < 2.63 | 2.63 |
| buffalo wxr-1750dhp2_firmware | v < 2.63 | 2.63 |
| buffalo wxr18000be10p_firmware | v < 5.03 | 5.03 |
| buffalo wxr-1900dhp_firmware | v < 2.53 | 2.53 |
| buffalo wxr-1900dhp2_firmware | v < 2.62 | 2.62 |
| buffalo wxr-1900dhp3_firmware | v < 2.66 | 2.66 |
| buffalo wxr-5950ax12_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12b_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12p_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12s_firmware | v < 3.57 | 3.57 |
| buffalo wzr-1166dhp_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1166dhp2_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1750dhp_firmware | v < 2.32 | 2.32 |
| buffalo wzr-1750dhp2_firmware | v < 2.33 | 2.33 |
| buffalo wzr-s1750dhp_firmware | v < 2.34 | 2.34 |
| buffalo wrm-d2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wrm-d2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wem-1266_firmware | v < 2.87 | 2.87 |
| buffalo wem-1266wp_firmware | v < 2.87 | 2.87 |
| buffalo vr-u300w_firmware | v < 1.42 | 1.42 |
| buffalo vr-u500x_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpra_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1750d_firmware | v < 1.07 | 1.07 |
| buffalo wapm-2133r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-2133tr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax4r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax8r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-axetr_firmware | v < 1.42 | 1.42 |
| buffalo waps-1266_firmware | v < 1.42 | 1.42 |
| buffalo waps-ax4_firmware | v < 1.42 | 1.42 |
| buffalo fs-m1266_firmware | v < 4.13 | 4.13 |
| buffalo fs-s1266_firmware | v < 4.13 | 4.13 |
| buffalo wzr-600dhp_firmware | No range specified | — |
| buffalo wzr-600dhp2_firmware | No range specified | — |
| buffalo wzr-600dhp3_firmware | No range specified | — |
| buffalo wzr-900dhp_firmware | No range specified | — |
| buffalo wzr-900dhp2_firmware | No range specified | — |
| buffalo wzr-s600dhp_firmware | No range specified | — |
| buffalo wzr-s900dhp_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.