CVE-2026-33366: Buffalo Fs-m1266 Firmware

Medium severity, CVSS 6.9. EPSS: 0.6% chance of exploitation in the next 30 days.

Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication.

Affected products

• Buffalo Fs-m1266 Firmware: before 4.13 (fixed in 4.13)
• Buffalo Fs-s1266 Firmware: before 4.13 (fixed in 4.13)
• Buffalo Vr-u300w Firmware: before 1.42 (fixed in 1.42)
• Buffalo Vr-u500x Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-1266r Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-1266wdpr Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-1266wdpra Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-1750d Firmware: before 1.07 (fixed in 1.07)
• Buffalo Wapm-2133r Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-2133tr Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-AX4R Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-AX8R Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wapm-Axetr Firmware: before 1.42 (fixed in 1.42)
• Buffalo Waps-1266 Firmware: before 1.42 (fixed in 1.42)
• Buffalo Waps-AX4 Firmware: before 1.42 (fixed in 1.42)
• Buffalo Wcr-1166dhpl Firmware: before 1.01 (fixed in 1.01)
• Buffalo Wem-1266 Firmware: before 2.87 (fixed in 2.87)
• Buffalo Wem-1266wp Firmware: before 2.87 (fixed in 2.87)
• Buffalo Wrm-d2133hp Firmware: before 3.01 (fixed in 3.01)
• Buffalo Wrm-d2133hs Firmware: before 3.01 (fixed in 3.01)
• Buffalo WSR3600BE4-Kh Firmware: before 6.02 (fixed in 6.02)
• Buffalo WSR3600BE4P Firmware: before 5.02 (fixed in 5.02)
• Buffalo Wtr-m2133hp Firmware: before 3.01 (fixed in 3.01)
• Buffalo Wtr-m2133hs Firmware: before 3.01 (fixed in 3.01)
• Buffalo Wxr-1750dhp2 Firmware: before 2.63 (fixed in 2.63)
• and 21 more

Published 2026-03-27. Last modified 2026-06-17.