An authentication bypass flaw in the web‑based administration interface of Buffalo Wi‑Fi routers allows an attacker to make configuration changes without any credentials. The flaw is a failure in verifying authentication before accepting configuration commands, enabling manipulation of network settings, opening services, or redirecting traffic. The weakness is classified as CWE‑288, imposing a high risk to confidentiality, integrity, and availability of the network served by the device.

The vulnerability affects a broad set of Buffalo Inc. Wi‑Fi router products. Models include FS‑M1266, FS‑S1266, VR‑U300W, VR‑U500X, WAPM‑1266, WAPM‑1266WDPR, WAPM‑2133, WAPM‑AX4, WAPM‑AX8, WAPM‑AXEtr, WAPS‑1266, WAPS‑AX4, WCR‑1166DHPL, WEM‑1266, WRM‑D2133, WSR‑3600, WTR‑M2133, WXR‑1750, WXR‑1900, WXRT‑6000, WXRT‑18000, WZR‑1166, WZR‑1750, WZR‑600, WZR‑900 and several related variants as enumerated in the supplied CPE list.

The CVSS base score of 8.7 indicates a high severity vulnerability. EPSS shows exploitation probability is currently below 1 %, and the flaw is not listed in CISA’s KEV catalog. Inferred attack vector is the router’s remote management interface, requiring only access to the device’s IP or hostname; the attacker does not need authentication, making exploitation straightforward once the device is reachable. Although the threat score is high, actual exploitation depends on network exposure of the router.