A hidden debug functionality in Buffalo Wi‑Fi router products enables the execution of arbitrary operating system commands, providing an attacker with full control of the device. The flaw is described by CWE‑912, a weakness that allows remote code execution through untrusted input. Successful exploitation would compromise the router, potentially allowing traffic interception, unauthorized network access, or persistence on the network.

The vulnerability affects all Buffalo Wi‑Fi router products distributed by Buffalo Inc. Specific firmware or model numbers are not listed, so any device containing the undocumented debug feature may be vulnerable. Users should review their router’s firmware version and consult the vendor for updates or guidance.

With a CVSS score of 8.6, the vulnerability has a high severity rating, indicating significant impact if exploited. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, but these omissions do not reduce the potential risk. Based on the description, it is inferred that the debugging interface may be accessed remotely via the router’s management network interface, requiring network connectivity and possibly local administrative credentials. The exploit’s success would grant the attacker high privileges on the device, enabling a range of malicious actions.