The vulnerability allows an attacker to inject operating system commands through a web interface on affected BUFFALO Wi‑Fi router products. Executing such commands gives the attacker full control of the device, enabling data exfiltration, persistent compromise, or use of the router as a launch pad for further attacks. The weakness is a classic OS command injection flaw.

BUFFALO Wi‑Fi router products are impacted. Specific model names and firmware versions are not detailed in the advisory, so all devices in the BUFFALO Wi‑Fi product line should be treated as potentially vulnerable until further information is obtained.

With a CVSS score of 8.6, the vulnerability is classified as high severity. Exploit probability data from EPSS is unavailable, and the issue is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, originating from interactions with the router’s web interface; no local prerequisites are described, suggesting that any network‑connected user who can access the interface may be able to exploit the flaw.