Back to the CVE list
CVE-2026-32678

Vulnerability in Buffalo Wzr S900dhp Firmware

CVSS score

7.5

EPSS probability

%0.4

Risk score

0.0

Published

7 mo ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2026-32678 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2026-32678 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1buffalowzr-s900dhp firmware View
2buffalowzr-s900dhp View
3buffalowcr-1166dhpl firmware View
4buffalowcr-1166dhpl View
5buffalowsr3600be4-kh firmware View
6buffalowsr3600be4-kh View
7buffalowsr3600be4p firmware View
8buffalowsr3600be4p View
9buffalowxr-1750dhp firmware View
10buffalowxr-1750dhp View
11buffalowxr-1750dhp2 firmware View
12buffalowxr-1750dhp2 View
13buffalowxr18000be10p firmware View
14buffalowxr18000be10p View
15buffalowxr-1900dhp firmware View
16buffalowxr-1900dhp View
17buffalowxr-1900dhp2 firmware View
18buffalowxr-1900dhp2 View
19buffalowxr-1900dhp3 firmware View
20buffalowxr-1900dhp3 View
21buffalowxr-5950ax12 firmware View
22buffalowxr-5950ax12 View
23buffalowxr-6000ax12b firmware View
24buffalowxr-6000ax12b View
25buffalowxr-6000ax12p firmware View
26buffalowxr-6000ax12p View
27buffalowxr-6000ax12s firmware View
28buffalowxr-6000ax12s View
29buffalowzr-1166dhp firmware View
30buffalowzr-1166dhp View
31buffalowzr-1166dhp2 firmware View
32buffalowzr-1166dhp2 View
33buffalowzr-1750dhp firmware View
34buffalowzr-1750dhp View
35buffalowzr-1750dhp2 firmware View
36buffalowzr-1750dhp2 View
37buffalowzr-s1750dhp firmware View
38buffalowzr-s1750dhp View
39buffalowrm-d2133hp firmware View
40buffalowrm-d2133hp View
41buffalowrm-d2133hs firmware View
42buffalowrm-d2133hs View
43buffalowtr-m2133hp firmware View
44buffalowtr-m2133hp View
45buffalowtr-m2133hs firmware View
46buffalowtr-m2133hs View
47buffalowem-1266 firmware View
48buffalowem-1266 View
49buffalowem-1266wp firmware View
50buffalowem-1266wp View
51buffalovr-u300w firmware View
52buffalovr-u300w View
53buffalovr-u500x firmware View
54buffalovr-u500x View
55buffalowapm-1266r firmware View
56buffalowapm-1266r View
57buffalowapm-1266wdpr firmware View
58buffalowapm-1266wdpr View
59buffalowapm-1266wdpra firmware View
60buffalowapm-1266wdpra View
61buffalowapm-1750d firmware View
62buffalowapm-1750d View
63buffalowapm-2133r firmware View
64buffalowapm-2133r View
65buffalowapm-2133tr firmware View
66buffalowapm-2133tr View
67buffalowapm-ax4r firmware View
68buffalowapm-ax4r View
69buffalowapm-ax8r firmware View
70buffalowapm-ax8r View
71buffalowapm-axetr firmware View
72buffalowapm-axetr View
73buffalowaps-1266 firmware View
74buffalowaps-1266 View
75buffalowaps-ax4 firmware View
76buffalowaps-ax4 View
77buffalofs-m1266 firmware View
78buffalofs-m1266 View
79buffalofs-s1266 firmware View
80buffalofs-s1266 View
81buffalowzr-600dhp firmware View
82buffalowzr-600dhp View
83buffalowzr-600dhp2 firmware View
84buffalowzr-600dhp2 View
85buffalowzr-600dhp3 firmware View
86buffalowzr-600dhp3 View
87buffalowzr-900dhp firmware View
88buffalowzr-900dhp View
89buffalowzr-900dhp2 firmware View
90buffalowzr-900dhp2 View
91buffalowzr-s600dhp firmware View
92buffalowzr-s600dhp View
Total affected vendors: 1|Products: 92

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.7CVSS V40HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD
7.5CVSS V30HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-32678 is associated with the following CWEs:

CWE-288: Common Weakness Enumeration Entry CWE-288

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-32678 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsGerekmiyor
UserGerekmiyor

Official Sources and Advisories

https://jvn.jp/en/jp/JVN83788689/nvdhttps://www.buffalo.jp/news/detail/20260323-01.htmlvendor-advisory

CVSS Vector Radar Chart

7.5 / 10
Attack VectorNetworkComplexityLowPrivilegesNoneUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityNone

Vulnerability Scoring Details

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone required
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)None

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

B
buffalo logo
buffalo

Weakness Type (CWE & CAPEC)

CWE-288

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-32678"
CVE-2026-32678 · Vulnerability in Buffalo Wzr S900dhp Firmware