Vendor
Buffalo vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 8 vulnerabilities in Buffalo: 0 in the last 7 days and 2 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95104, was published on 28 September 2026. Nothing in the last four weeks, down from 2 vulnerabilities in the four before. 92 technologies have a page of their own.
- Last 7 days
- 0
- Last 90 days
- 2
- Critical, all time
- 3
- Exploited in the wild
- 0
About Buffalo
Buffalo Inc. is a manufacturer of computer peripherals, including network-attached storage, routers, and portable hard drives.
Buffalo technologies
- Buffalo Fs-M12665
- Buffalo Fs-M1266 Firmware5
- Buffalo Fs-S12665
- Buffalo Fs-S1266 Firmware5
- Buffalo Vr-U300w5
- Buffalo Vr-U300w Firmware5
- Buffalo Vr-U500x5
- Buffalo Vr-U500x Firmware5
- Buffalo Wapm-1266r5
- Buffalo Wapm-1266r Firmware5
- Buffalo Wapm-1266wdpr5
- Buffalo Wapm-1266wdpr Firmware5
- Buffalo Wapm-1266wdpra5
- Buffalo Wapm-1266wdpra Firmware5
- Buffalo Wapm-1750d5
- Buffalo Wapm-1750d Firmware5
- Buffalo Wapm-2133r5
- Buffalo Wapm-2133r Firmware5
- Buffalo Wapm-2133tr5
- Buffalo Wapm-2133tr Firmware5
- Buffalo Wapm-Ax4r5
- Buffalo Wapm-Ax4r Firmware5
- Buffalo Wapm-Ax8r5
- Buffalo Wapm-Ax8r Firmware5
- Buffalo Wapm-Axetr5
- Buffalo Wapm-Axetr Firmware5
- Buffalo Waps-12665
- Buffalo Waps-1266 Firmware5
- Buffalo Waps-Ax45
- Buffalo Waps-Ax4 Firmware5
- Buffalo Wcr-1166dhpl5
- Buffalo Wcr-1166dhpl Firmware5
- Buffalo Wem-12665
- Buffalo Wem-1266 Firmware5
- Buffalo Wem-1266wp5
- Buffalo Wem-1266wp Firmware5
- Buffalo Wrm-D2133hp5
- Buffalo Wrm-D2133hp Firmware5
- Buffalo Wrm-D2133hs5
- Buffalo Wrm-D2133hs Firmware5
- Buffalo Wsr3600be4-Kh5
- Buffalo Wsr3600be4-Kh Firmware5
- Buffalo Wsr3600be4p5
- Buffalo Wsr3600be4p Firmware5
- Buffalo Wtr-M2133hp5
- Buffalo Wtr-M2133hp Firmware5
- Buffalo Wtr-M2133hs5
- Buffalo Wtr-M2133hs Firmware5
- Buffalo Wxr-1750dhp5
- Buffalo Wxr-1750dhp Firmware5
- Buffalo Wxr-1750dhp25
- Buffalo Wxr-1750dhp2 Firmware5
- Buffalo Wxr-1900dhp5
- Buffalo Wxr-1900dhp Firmware5
- Buffalo Wxr-1900dhp25
- Buffalo Wxr-1900dhp2 Firmware5
- Buffalo Wxr-1900dhp35
- Buffalo Wxr-1900dhp3 Firmware5
- Buffalo Wxr-5950ax125
- Buffalo Wxr-5950ax12 Firmware5
- Buffalo Wxr-6000ax12b5
- Buffalo Wxr-6000ax12b Firmware5
- Buffalo Wxr-6000ax12p5
- Buffalo Wxr-6000ax12p Firmware5
- Buffalo Wxr-6000ax12s5
- Buffalo Wxr-6000ax12s Firmware5
- Buffalo Wxr18000be10p5
- Buffalo Wxr18000be10p Firmware5
- Buffalo Wzr-1166dhp5
- Buffalo Wzr-1166dhp Firmware5
- Buffalo Wzr-1166dhp25
- Buffalo Wzr-1166dhp2 Firmware5
- Buffalo Wzr-1750dhp5
- Buffalo Wzr-1750dhp Firmware5
- Buffalo Wzr-1750dhp25
- Buffalo Wzr-1750dhp2 Firmware5
- Buffalo Wzr-600dhp5
- Buffalo Wzr-600dhp Firmware5
- Buffalo Wzr-600dhp25
- Buffalo Wzr-600dhp2 Firmware5
- Buffalo Wzr-600dhp35
- Buffalo Wzr-600dhp3 Firmware5
- Buffalo Wzr-900dhp5
- Buffalo Wzr-900dhp Firmware5
- Buffalo Wzr-900dhp25
- Buffalo Wzr-900dhp2 Firmware5
- Buffalo Wzr-S1750dhp5
- Buffalo Wzr-S1750dhp Firmware5
- Buffalo Wzr-S600dhp5
- Buffalo Wzr-S600dhp Firmware5
- Buffalo Wzr-S900dhp5
- Buffalo Wzr-S900dhp Firmware5
Latest Buffalo vulnerabilities
- CVE-2026-95104: Buffalo WSR-300HP and WEX-G300 stack-based buffer overflowhighCVSS 7.5
- CVE-2026-86530: BUFFALO Wi-Fi products OS command injectionhighCVSS 7.2
- CVE-2026-33366: Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to…mediumCVSS 5.3EPSS 0.4%
- CVE-2026-33280: Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the…criticalCVSS 9.8EPSS 0.4%
- CVE-2026-32678: Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical…highCVSS 7.5EPSS 0.4%
- CVE-2026-32669: Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary…criticalCVSS 9.8EPSS 0.3%
- CVE-2026-27650: OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an…criticalCVSS 9.8EPSS 0.9%
- CVE-2026-29516: Buffalo TeraStation NAS TS5400R excessive file permissions in /etc/shadowmediumCVSS 4.9
Most severe Buffalo vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-27650: OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an…criticalCVSS 9.8EPSS 0.9%
- CVE-2026-33280: Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the…criticalCVSS 9.8EPSS 0.4%
- CVE-2026-32669: Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary…criticalCVSS 9.8EPSS 0.3%
- CVE-2026-32678: Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical…highCVSS 7.5EPSS 0.4%
- CVE-2026-95104: Buffalo WSR-300HP and WEX-G300 stack-based buffer overflowhighCVSS 7.5
- CVE-2026-86530: BUFFALO Wi-Fi products OS command injectionhighCVSS 7.2
- CVE-2026-33366: Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to…mediumCVSS 5.3EPSS 0.4%
- CVE-2026-29516: Buffalo TeraStation NAS TS5400R excessive file permissions in /etc/shadowmediumCVSS 4.9
Vulnerabilities per week
Nothing in the last four weeks, down from 2 vulnerabilities in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 2 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Buffalo vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/buffalo)<a href="https://junglewise.ai/threats/vendors/buffalo"><img src="https://junglewise.ai/threats/vendors/buffalo/badge.svg" alt="Buffalo vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/buffalo.json, and this page as text at https://junglewise.ai/threats/vendors/buffalo.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Buffalo vulnerabilities", https://junglewise.ai/threats/vendors/buffalo, 9 November 2026.