An OS command injection flaw allows an attacker to execute arbitrary commands on Buffalo Wi‑Fi router firmware, leading to complete compromise of the device. The vulnerability could be used to exfiltrate sensitive data, alter network traffic, or disrupt connectivity, thereby impacting confidentiality, integrity, and availability.

The flaw affects a broad range of Buffalo Wi‑Fi router products, including models such as FS‑M1266, FS‑S1266, VR‑U300W, VR‑U500X, WAPM‑1266, WAPM‑1750, WRM‑D2133, WSR‑3600, WTR‑M2133, various WX‑R and WZR series. Affected firmware versions are unspecified, so any currently deployed firmware of these devices may be vulnerable.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a relatively low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and no public exploit has been reported. The likely attack vector is inferred to be remote network access via the device’s web or configuration interface, which could expose the command injection payload to unauthenticated or authenticated users with sufficient privileges.