Missing authentication for a critical function allows an attacker to forcibly reboot a Buffalo Wi‑Fi router. The described vulnerability enables a reboot command to be issued without valid credentials, leading to a brief loss of connectivity for all users of the device. The impact is limited to availability; there is no evidence that confidentiality or integrity is compromised, and the vulnerability does not allow arbitrary code execution.

The flaw affects a broad set of Buffalo router models, including the FS‑M1266, FS‑S1266, VR‑U300W, VR‑U500X, various WAPM, WAPS, WCR, WEM, WRM, WSR3600, WTR, WX‑R, and WZR series. All firmware versions that implement the exposed reboot function are vulnerable. Owners of any of these models should verify the firmware version and apply updates if available.

The CVSS score of 6.9 indicates medium severity. The EPSS score of less than 1 % suggests that exploitation is unlikely in the wild. Information on existing public exploits is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The anplied attack vector is inferred to be remote network access to the router’s administrative interface or an exposed management protocol, as the description indicates bypass of authentication. An attacker only needs network reachability to trigger the reboot, requiring no credentials. The resulting denial of service is short‑term, occurring when the unit restarts, but repeated forced reboots could degrade availability and degrade user experience.