Loading story…
Two high-severity vulnerabilities have been disclosed in BUFFALO Wi-Fi router products, exposing affected devices to arbitrary code execution and OS command execution. CVE-2026-32669 is classified as CWE-94 and allows code injection that could let an attacker run arbitrary code on vulnerable routers, while CVE-2026-33280 is a CWE-912 hidden functionality flaw that could expose debugging features and enable arbitrary OS commands.
Both issues carry high impact across confidentiality, integrity, and availability, with published scoring indicating network-based exploitation and low attack complexity for the command injection issue. The vulnerability records list JPCERT/CC as the receiving party, and references were added to JVN and a BUFFALO advisory page, signaling vendor and coordination activity around the affected router line.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability record for CVE-2026-27650 was received on March 27, 2026, describing an OS command injection flaw in BUFFALO Wi-Fi router products that could allow arbitrary OS command execution. The entry references JVN and a BUFFALO advisory and maps the issue to CWE-78 with high severity impact.
A new vulnerability record for CVE-2026-33280 was recorded on March 27, 2026, affecting BUFFALO Wi-Fi router products. The flaw is described as hidden functionality that could expose debugging features and enable arbitrary OS command execution, with high impact across confidentiality, integrity, and availability.
A new vulnerability record for CVE-2026-32669 was received on March 27, 2026, describing a code injection flaw in BUFFALO Wi-Fi router products that could allow arbitrary code execution. The entry references JVN and a BUFFALO advisory and classifies the issue as CWE-94 with high confidentiality, integrity, and availability impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Three critical vulnerabilities, **CVE-2026-7121**, **CVE-2026-7122**, and **CVE-2026-7125**, were disclosed in the **Totolink A8000RU** router running firmware `7.1cu.643_b20200521`, all affecting the `/cgi-bin/cstecgi.cgi` CGI handler. The flaws are OS command injection issues in the `setWizardCfg`, `setUPnPCfg`, and `setWiFiEasyCfg` functions, where crafted input to the `wizard`, `enable`, and `merge` arguments can trigger command execution on the device. The vulnerabilities are mapped to **CWE-78** and **CWE-77** and were rated critical across **CVSS v2**, **CVSS v3.1**, and **CVSS v4.0** scoring schemes. All three issues are remotely exploitable over the network and require **no privileges** and **no user interaction**, creating a high-risk exposure for internet-accessible devices. Public exploit information has already been disclosed, with references including VulDB entries and a GitHub proof-of-concept, increasing the likelihood of near-term exploitation. The disclosures indicate that multiple administrative configuration paths in the router's web interface can be abused for remote code execution, making unpatched A8000RU systems a priority for immediate review and remediation.
Jun 29, 2026
Zyxel's **WAH7601** portable 4G router is affected by a set of four vulnerabilities, including the critical unauthenticated OS command injection flaw **`CVE-2026-13206`** and the high-severity credential exposure issue **`CVE-2026-12984`**. According to TR-CERT advisory **`TR-26-0799`**, all four flaws affect firmware through build **`20072026`**. The command injection bug is remotely exploitable and carries a **CVSS 9.8** score, while the credential issue, scored **CVSS 8.2**, can allow unauthorized retrieval of embedded sensitive data. The reported impact includes **root-level remote code execution**, credential theft, traffic interception, persistence on the device, and possible pivoting into internal networks after compromise. Public reporting said no active exploitation had been observed, but also noted that the vulnerabilities were **unpatched** at disclosure time. Recommended defenses include updating to the latest firmware if available, applying any vendor fixes, restricting or removing internet exposure of the management interface, strengthening access credentials, and replacing the device if access cannot be adequately controlled.
Aug 11, 2026
Two critical vulnerabilities, **CVE-2026-5851** and **CVE-2026-5976**, were disclosed in the **Totolink A7100RU** router running firmware `7.4cu.2313_b20191024`, exposing the device to remote **OS command injection** without authentication or user interaction. Both flaws affect `/cgi-bin/cstecgi.cgi` in the router's CGI handler: CVE-2026-5851 is tied to the `setUPnPCfg` function through the `enable` argument, while CVE-2026-5976 affects the `setStorageCfg` function through the `sambaEnabled` argument. The vulnerabilities were classified under **CWE-78** and **CWE-77** and were assigned high to critical severity across CVSS versions, reflecting potential compromise of confidentiality, integrity, and availability. Public exploit information has reportedly been released, including references to **VulDB** and a **GitHub** disclosure repository, increasing the likelihood of exploitation against exposed devices that have not been updated or otherwise mitigated.
Jun 29, 2026