CVE-2026-86530
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| BUFFALO INC. | WSR-300HP | 0 < Ver.2.55 | affected |
| BUFFALO INC. | WEX-G300 | 0 < Ver.1.71 | affected |
Weaknesses
- CWE-78: Improper neutralization of special elements used in an OS command ('OS Command Injection')
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.