Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.

Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.

Wi-Fi router products provided by BUFFALO INC. contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/1395.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/94.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/288.html' target='_blank'></a><a href='http://cwe.mitre.org/data/definitions/912.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/306.html' target='_blank'></a><ul><li>Dependency on vulnerable third-party component (CWE-1395) - This issue is caused by a vulnerability in mini_httpd (CVE-2015-1548).</li><li>OS command injection (CWE-78) - CVE-2026-27650</li><li>Code injection (CWE-94) - CVE-2026-32669</li><li>Authentication bypass using an alternate path or channel (CWE-288) - CVE-2026-32678</li><li>Hidden functionality (CWE-912) - CVE-2026-33280</li><li>Missing authentication for critical function (CWE-306) - CVE-2026-33366</li></ul>CVE-2015-1548 Justus W. Perlwitz of JWP Consulting reported this vulnerability to BUFFALO INC. and coordinated. After the coordination was completed, BUFFALO INC. reported the case to JPCERT/CC to notify users of the solution through JVN. CVE-2026-27650 Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-…