CVE-2026-32669 is a critical code injection flaw in BUFFALO Wi-Fi router products, scored CVSS 9.8. Arbitrary code may run on an affected device. BUFFALO and JPCERT/CC both tell owners to update the firmware, and models past end of support get no fix, so replace them.
What's affected
The NVD record lists the FS-M1266, FS-S1266, VR-U300W and VR-U500X products with their firmware. The vendor notice covers many more models, grouped as a supported list (Product A) and an end of support list (Product B). I could not match each model to this specific CVE with certainty, so use the vendor table for your exact model.
For supported models, the vendor lists the first fixed firmware version per model. Examples from the table include Ver.4.13 or later for FS-M1266 and FS-S1266, and Ver.1.42 or later for VR-U300W and VR-U500X. The vendor says auto update is on by default for most of these models.
Models in the end of support list, such as the WZR-600DHP and WZR-900DHP families, get no firmware. The vendor recommends stopping their use.
How to check if you're exposed
Open the router administration page and read the model name and firmware version. Compare them with the table in the BUFFALO notice (published 23 March 2026) and with JVN#83788689.
If auto update is on, the vendor says the update may already be applied. Confirm it in the firmware page instead of assuming.
Check whether the remote access setting for the internet side is enabled. The vendor notes that when it is on, attacks can be launched from the internet.
What to do now
- Look up your model in the BUFFALO notice and update to the listed firmware or later.
- Turn off the option that allows remote access from the internet side unless you need it.
- Replace any router in the end of support list. No fix will arrive for it.
- After updating, change the administration password and review settings you did not make.
- Keep automatic firmware update on where the model supports it.
Why it matters
The class is CWE-94, code injection. JVN describes the impact as arbitrary code running on the product, and notes that the attacker needs user interaction according to the CVSS 3.0 vector in its table, while NVD scores the issue 9.8.
Routers sit at the network edge and see all traffic. They are rarely patched by hand, which is why vendors lean on auto update. The same notice covers several other flaws, so updating fixes more than this one. The record's KEV flag is false.
Quick check
My model is old. Is there a patch?
Only for models in the vendor's supported list. For models in the end of support list, the vendor offers no firmware and recommends you stop using them.
Sources
Last reviewed: 19 October 2026.
