CVE-2026-27650 is a critical OS command injection (CVSS 9.8 in the record) in BUFFALO Wi-Fi routers. If exploited, arbitrary operating system commands can run on the device. Check your model against the Buffalo notice and install the firmware it lists as the fix.
What's affected
The record lists the Buffalo FS-M1266, FS-S1266, VR-U300W and VR-U500X families with their firmware. The JVN notice (JVN#83788689) covers multiple Buffalo router vulnerabilities in one bulletin, and CVE-2026-27650 is its OS command injection item. JVN gives its own score of 8.8 under CVSS 3.0, with user interaction required, which differs from the NVD vector in the record.
Buffalo's notice describes this item as letting an attacker who has logged in to the device run arbitrary OS commands. It also says that if the Internet side remote access setting is enabled, attacks may come from the internet.
Fixed firmware versions vary by model in Buffalo's table, so use the vendor page and do not guess. The KEV flag is false.
How to check if you're exposed
- Find the model name on the label of the device.
- Open the router's administration page and read the firmware version.
- Compare it with the fixed firmware for your model in the Buffalo notice, which is written in Japanese, with the JVN page as an English reference.
- Check whether the setting that allows remote access from the Internet side is on.
What to do now
- Update the firmware to the version Buffalo lists for your model. Many models have automatic update, so confirm it ran.
- Turn off the Internet side remote access setting unless you truly need it.
- Change the administrator password to a strong unique one, since the command injection needs a logged in session.
- Retire models that no longer get firmware updates.
- For fleets, record router models and versions in your asset inventory.
Why it matters
The weakness is CWE-78, OS command injection. A web management page takes input and passes it, without safe handling, to the operating system. On a router, that gives full control of a device that sees all traffic in the network.
The scoring difference is worth understanding. NVD rates it as needing no privileges and no user interaction, while JVN, working from the vendor's analysis, rates it lower and notes that user interaction is needed. Either way, the same action applies: patch, and keep the management interface away from the internet.
Quick check
Do I need to be logged in to be attacked?
Buffalo's notice describes an attacker who has logged in to the device. Remote access from the internet raises the exposure, so turn it off.
Sources
Last reviewed: 19 October 2026.
