CVE-2026-33366
Medium
Description
Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication.
SeverityMedium
CVSS6.9
Exploit probability—
ProductBuffalo Wcr-1166dhpl Firmware
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- buffalo wcr-1166dhpl_firmware1.01 or later
- buffalo wsr3600be4-kh_firmware6.02 or later
- buffalo wsr3600be4p_firmware5.02 or later
- buffalo wxr-1750dhp_firmware2.63 or later
- buffalo wxr-1750dhp2_firmware2.63 or later
- buffalo wxr18000be10p_firmware5.03 or later
- buffalo wxr-1900dhp_firmware2.53 or later
- buffalo wxr-1900dhp2_firmware2.62 or later
- buffalo wxr-1900dhp3_firmware2.66 or later
- buffalo wxr-5950ax12_firmware3.57 or later
- buffalo wxr-6000ax12b_firmware3.57 or later
- buffalo wxr-6000ax12p_firmware3.57 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| buffalo wcr-1166dhpl_firmware | v < 1.01 | 1.01 |
| buffalo wsr3600be4-kh_firmware | v < 6.02 | 6.02 |
| buffalo wsr3600be4p_firmware | v < 5.02 | 5.02 |
| buffalo wxr-1750dhp_firmware | v < 2.63 | 2.63 |
| buffalo wxr-1750dhp2_firmware | v < 2.63 | 2.63 |
| buffalo wxr18000be10p_firmware | v < 5.03 | 5.03 |
| buffalo wxr-1900dhp_firmware | v < 2.53 | 2.53 |
| buffalo wxr-1900dhp2_firmware | v < 2.62 | 2.62 |
| buffalo wxr-1900dhp3_firmware | v < 2.66 | 2.66 |
| buffalo wxr-5950ax12_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12b_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12p_firmware | v < 3.57 | 3.57 |
| buffalo wxr-6000ax12s_firmware | v < 3.57 | 3.57 |
| buffalo wzr-1166dhp_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1166dhp2_firmware | v < 2.20 | 2.20 |
| buffalo wzr-1750dhp_firmware | v < 2.32 | 2.32 |
| buffalo wzr-1750dhp2_firmware | v < 2.33 | 2.33 |
| buffalo wzr-s1750dhp_firmware | v < 2.34 | 2.34 |
| buffalo wrm-d2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wrm-d2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hp_firmware | v < 3.01 | 3.01 |
| buffalo wtr-m2133hs_firmware | v < 3.01 | 3.01 |
| buffalo wem-1266_firmware | v < 2.87 | 2.87 |
| buffalo wem-1266wp_firmware | v < 2.87 | 2.87 |
| buffalo vr-u300w_firmware | v < 1.42 | 1.42 |
| buffalo vr-u500x_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1266wdpra_firmware | v < 1.42 | 1.42 |
| buffalo wapm-1750d_firmware | v < 1.07 | 1.07 |
| buffalo wapm-2133r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-2133tr_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax4r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-ax8r_firmware | v < 1.42 | 1.42 |
| buffalo wapm-axetr_firmware | v < 1.42 | 1.42 |
| buffalo waps-1266_firmware | v < 1.42 | 1.42 |
| buffalo waps-ax4_firmware | v < 1.42 | 1.42 |
| buffalo fs-m1266_firmware | v < 4.13 | 4.13 |
| buffalo fs-s1266_firmware | v < 4.13 | 4.13 |
| buffalo wzr-600dhp_firmware | No range specified | — |
| buffalo wzr-600dhp2_firmware | No range specified | — |
| buffalo wzr-600dhp3_firmware | No range specified | — |
| buffalo wzr-900dhp_firmware | No range specified | — |
| buffalo wzr-900dhp2_firmware | No range specified | — |
| buffalo wzr-s600dhp_firmware | No range specified | — |
| buffalo wzr-s900dhp_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.