CVE-2026-33280 is a hidden functionality flaw in several BUFFALO Wi-Fi router products. NVD scores it 9.8 critical. Someone who knows about the product's undocumented debugging feature may be able to run arbitrary OS commands. The fix is a firmware update to the version BUFFALO lists for your model.
What's affected
The NVD record lists the FS-M1266, FS-S1266, VR-U300W and VR-U500X along with their firmware. BUFFALO's notice (JVN#83788689) covers a much longer list of routers, repeaters, VPN routers and access points, and it marks which models carry the debug issue.
Each model has its own fixed firmware version. For example, the vendor table gives Ver.1.42 or later for the VR-U300W and VR-U500X. Read the table for your exact model rather than assuming a version.
Two details are worth knowing. JVN rates this specific issue lower than NVD does, with a high privileges requirement in its CVSS 3.0 vector (7.2). BUFFALO also says that if the setting that allows remote access from the internet side is on, attacks could come from the internet.
How to check if you're exposed
- Log in to the router's admin page and read the firmware version.
- Find your model in BUFFALO's notice (linked below) and compare against the fixed version in the last column.
- Check whether the internet side remote access setting is enabled. If it is, treat the device as more urgent.
What to do now
- Update the firmware to the version BUFFALO lists for your model. Many models have automatic update turned on by default, but confirm the version rather than trusting the setting.
- Turn off the internet side remote access setting unless you need it.
- Replace models that have no fixed firmware listed, or isolate them from untrusted networks.
- Add routers and access points to your asset inventory so the next advisory is a lookup, not a hunt.
Why it matters
The weakness class is CWE-912, hidden functionality. A debug interface left in shipping firmware is a back door even if nobody meant it to be one. Once its existence is known, the secrecy that protected it is gone.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and neither source I read says it is exploited. Routers sit at the network edge, so a command execution flaw there deserves a prompt update.
Quick check
Does my router need a patch if I only use it at home?
If it is one of the affected models, yes. Update the firmware and keep internet side remote access off.
Sources
Last reviewed: 19 October 2026.
