CVE-2026-33366 Missing authorization in BUFFALO Wi-Fi router products

Medium 6.9 Published 27 Mar 2026 Updated 27 Mar 2026

Attackers can forcibly reboot BUFFALO Wi-Fi routers without authentication, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33366?

CVE-2026-33366 is a medium-severity missing authorization vulnerability in BUFFALO Wi-Fi router products, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the product without authentication.

Weakness: CWE-306

Which versions are affected by CVE-2026-33366?

It affects 46 products.

Products include Buffalo Fs-M1266 Firmware, Buffalo Fs-S1266 Firmware, Buffalo Vr-U300w Firmware, Buffalo Vr-U500x Firmware, Buffalo Wapm-1266r Firmware, Buffalo Wapm-1266wdpr Firmware and 40 more.

How do I fix CVE-2026-33366?

No fix has been published for CVE-2026-33366 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33366 being exploited?

There is no known exploitation of CVE-2026-33366 in the wild and no public exploit code.

Sources

Also known as GHSA-h3gg-7vcj-v4m8.