CVE-2026-27650
Published: 27 March 2026
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2026-27650 is an OS Command Injection vulnerability (CWE-78) present in BUFFALO Wi-Fi router products. Published on 2026-03-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Exploitation enables attackers to execute arbitrary OS commands on the affected products.
The vulnerability is exploitable remotely over the network with low attack complexity, requiring no authentication or privileges and no user interaction. Successful attacks maintain an unchanged scope while achieving high impacts on confidentiality, integrity, and availability, potentially allowing full device compromise such as data theft, modification, or denial of service.
Advisories detailing mitigations and patches are available from JVN at https://jvn.jp/en/jp/JVN83788689/ and Buffalo at https://www.buffalo.jp/news/detail/20260323-01.html.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
CVE enables remote exploitation of public-facing router web interface (T1190) leading to arbitrary OS command execution via Unix shell (T1059.004).