CVE-2026-86530: Buffalo Inc Wex-g300

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command.

Affected products

• Buffalo Inc Wex-g300: before 1.71 (fixed in 1.71)
• Buffalo Inc Wsr-300hp: before 2.55 (fixed in 2.55)

Published 2026-09-28. Last modified 2026-09-30.