# cve.now: Buffalo Inc.

The newest entries naming Buffalo Inc. as an affected vendor (up to 200), of 53 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95104](https://cve.now/CVE-2026-95104.md): Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. (CVSS 7.5)
- [CVE-2026-86530](https://cve.now/CVE-2026-86530.md): BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. (CVSS 7.2)
- [CVE-2026-33366](https://cve.now/CVE-2026-33366.md): Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the pro (CVSS 5.3)
- [CVE-2026-33280](https://cve.now/CVE-2026-33280.md): Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging fu (CVSS 7.2)
- [CVE-2026-32678](https://cve.now/CVE-2026-32678.md): Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings wi (CVSS 7.5)
- [CVE-2026-32669](https://cve.now/CVE-2026-32669.md): Code injection vulnerability exists in BUFFALO Wi-Fi router products. (CVSS 8.8)
- [CVE-2026-27650](https://cve.now/CVE-2026-27650.md): OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. (CVSS 8.8)
- [CVE-2026-29516](https://cve.now/CVE-2026-29516.md): Buffalo TeraStation TS5400R Excessive File Permissions Information Disclosure (CVSS 6.9)
- [CVE-2025-46413](https://cve.now/CVE-2025-46413.md): Use of password hash with insufficient computational effort issue exists in BUFFALO Wi-Fi router 'WSR-1800AX4 series'. (CVSS 4.3)
- [CVE-2025-61941](https://cve.now/CVE-2025-61941.md): A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. (CVSS 7.2)
- [CVE-2025-61871](https://cve.now/CVE-2025-61871.md): NAS Navigator2 Windows version by BUFFALO INC. (CVSS 6.7)
- [CVE-2024-44072](https://cve.now/CVE-2024-44072.md): OS command injection vulnerability exists in BUFFALO wireless LAN routers and wireless LAN repeaters. (CVSS 5.7)
- [CVE-2024-26023](https://cve.now/CVE-2024-26023.md): OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands. (CVSS 4.2)
- [CVE-2024-23486](https://cve.now/CVE-2024-23486.md): Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker wi (CVSS 9.8)
- [CVE-2023-51363](https://cve.now/CVE-2023-51363.md): VR-S1000 firmware Ver. (no CVSS)
- [CVE-2023-46711](https://cve.now/CVE-2023-46711.md): VR-S1000 firmware Ver. (no CVSS)
- [CVE-2023-46681](https://cve.now/CVE-2023-46681.md): Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. (no CVSS)
- [CVE-2023-45741](https://cve.now/CVE-2023-45741.md): VR-S1000 firmware Ver. (no CVSS)
- [CVE-2023-26588](https://cve.now/CVE-2023-26588.md): Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product. (CVSS 7.5)
- [CVE-2023-24544](https://cve.now/CVE-2023-24544.md): Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. (CVSS 8.1)
- [CVE-2023-24464](https://cve.now/CVE-2023-24464.md): Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the pro (CVSS 5.4)
- [CVE-2022-43486](https://cve.now/CVE-2022-43486.md): Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable (CVSS 6.8)
- [CVE-2022-43466](https://cve.now/CVE-2022-43466.md): OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute (CVSS 6.8)
- [CVE-2022-43443](https://cve.now/CVE-2022-43443.md): OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a sp (CVSS 8.0)
- [CVE-2022-40966](https://cve.now/CVE-2022-40966.md): Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and acce (CVSS 8.8)
- [CVE-2022-39044](https://cve.now/CVE-2022-39044.md): Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege t (CVSS 6.8)
- [CVE-2022-34840](https://cve.now/CVE-2022-34840.md): Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration se (CVSS 6.5)
- [CVE-2021-20731](https://cve.now/CVE-2021-20731.md): WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allow an attacker to execute arbitrary OS commands wit (no CVSS)
- [CVE-2021-20730](https://cve.now/CVE-2021-20730.md): Improper access control vulnerability in WSR-1166DHP3 firmware Ver.1.16 and prior and WSR-1166DHP4 firmware Ver.1.02 and prior allows an att (no CVSS)
- [CVE-2021-3512](https://cve.now/CVE-2021-3512.md): Improper access control vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior, DWR-HP-G300NH firmware Ver.1.83 an (no CVSS)
- [CVE-2021-3511](https://cve.now/CVE-2021-3511.md): Disclosure of sensitive information to an unauthorized user vulnerability in Buffalo broadband routers (BHR-4GRV firmware Ver.1.99 and prior (no CVSS)
- [CVE-2021-20716](https://cve.now/CVE-2021-20716.md): Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04 and prior, WBR2-B11 (no CVSS)
- [CVE-2020-5606](https://cve.now/CVE-2020-5606.md): Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially (no CVSS)
- [CVE-2020-5605](https://cve.now/CVE-2020-5605.md): Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting v (no CVSS)
- [CVE-2018-0556](https://cve.now/CVE-2018-0556.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2018-0555](https://cve.now/CVE-2018-0555.md): Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file. (no CVSS)
- [CVE-2018-0554](https://cve.now/CVE-2018-0554.md): Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspe (no CVSS)
- [CVE-2018-0523](https://cve.now/CVE-2018-0523.md): Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2018-0522](https://cve.now/CVE-2018-0522.md): Buffer overflow in Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary code via a specially crafted f (no CVSS)
- [CVE-2018-0521](https://cve.now/CVE-2018-0521.md): Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device (no CVSS)
- [CVE-2017-10897](https://cve.now/CVE-2017-10897.md): Input validation issue in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows an attacker t (no CVSS)
- [CVE-2017-10896](https://cve.now/CVE-2017-10896.md): Cross-site scripting vulnerability in Buffalo BBR-4HG and and BBR-4MG broadband routers with firmware 1.00 to 1.48 and 2.00 to 2.07 allows a (no CVSS)
- [CVE-2017-10811](https://cve.now/CVE-2017-10811.md): Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2017-2274](https://cve.now/CVE-2017-2274.md): Cross-site scripting vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers (no CVSS)
- [CVE-2017-2273](https://cve.now/CVE-2017-2273.md): Cross-site request forgery (CSRF) vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remo (no CVSS)
- [CVE-2017-2126](https://cve.now/CVE-2017-2126.md): WAPM-1166D firmware Ver.1.2.7 and earlier, WAPM-APG600H firmware Ver.1.16.1 and earlier allows remote attackers to bypass authentication and (no CVSS)
- [CVE-2016-7826](https://cve.now/CVE-2016-7826.md): Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to rea (no CVSS)
- [CVE-2016-7825](https://cve.now/CVE-2016-7825.md): Directory traversal vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to rea (no CVSS)
- [CVE-2016-7824](https://cve.now/CVE-2016-7824.md): Buffalo NC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to bypass access restriction to enable the d (no CVSS)
- [CVE-2016-7823](https://cve.now/CVE-2016-7823.md): Cross-site scripting vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows authenticated attackers to in (no CVSS)
- [CVE-2016-7822](https://cve.now/CVE-2016-7822.md): Cross-site request forgery (CSRF) vulnerability in Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allows remote attackers (no CVSS)
- [CVE-2016-7821](https://cve.now/CVE-2016-7821.md): Buffalo WNC01WH devices with firmware version 1.0.0.8 and earlier allow remote attackers to cause a denial of service against the management (no CVSS)
- [CVE-2017-2152](https://cve.now/CVE-2017-2152.md): WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/buffalo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.