A hidden debugging feature in a range of Buffalo Wi‑Fi routers allows an attacker to invoke arbitrary operating‑system commands, giving the attacker direct control over the device’s firmware and software environment. The vulnerability is associated with insufficient access controls for the debug interface and is reflected by CWE‑912. Exploitation results in the ability to run any command the router’s underlying operating system permits, potentially compromising device integrity and availability.

The flaw affects many Buffalo products, including the FS‑M1266, FS‑S1266, VR‑U300W, VR‑U500X, and various models in the WAPM, WAPS, WCR, WEM, WRM, WSR, WTR, WXR, and WZR families. No specific firmware release numbers are identified, so all current firmware versions may be vulnerable until a vendor update is released.

The CVSS score of 8.6 places this issue in the high‑severity range, indicating a serious threat. EPSS scoring shows less than 1% probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote access to the router’s management or diagnostic interface, which a malicious actor could use to trigger the hidden debugging functions.