Command Injection Vulnerability in BUFFALO Wi-Fi Products
CVE-2026-86530

8.6HIGH

Key Information:

Vendor

Buffalo Inc.

Status
Wsr-300HP
Wex-g300
Vendor
CVE Published:
28 September 2026

What is CVE-2026-86530?

Certain BUFFALO Wi-Fi products have a vulnerability that arises from improper handling of web form input. This flaw enables an administrative user to craft an HTTP request that can execute arbitrary commands in the operating system, potentially leading to unauthorized control over the device. Users are advised to review their configurations and apply any necessary patches to mitigate associated risks.

Affected Version(s)

WEX-G300 0

WSR-300HP 0

References

https://www.buffalo.jp/news/detail/20260928-01.html
https://jvn.jp/en/vu/JVNVU94863997/

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.