Buffalo WSR3600BE4-Kh Firmware vulnerabilities

5 CVEs affecting Buffalo WSR3600BE4-Kh Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-33366, published 2026-03-27.

More from Buffalo.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-27650, published 2026-03-27. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.
• CVE-2026-33280, published 2026-03-27. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS…
• CVE-2026-33366, published 2026-03-27. Medium severity, CVSS 6.9. EPSS: 0.6% chance of exploitation in the next 30 days. Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication.
• CVE-2026-32678, published 2026-03-27. High severity, CVSS 8.7. EPSS: 0.5% chance of exploitation in the next 30 days. Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings without authentication.
• CVE-2026-32669, published 2026-03-27. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed on the products.