Buffalo WSR-300HP CVE-2026-95104

Exploitation requires network access to the HTTP management interface of a Buffalo WSR-300HP router or WEX-G300 Wi-Fi extender; no authentication or user interaction is needed (PR:N/UI:N). The realistic limiting factor is reachability: these are consumer/SOHO devices normally exposed only on the LAN/Wi-Fi segment, so an attacker must be on the local network unless remote web administration has been enabled toward the WAN. Impact is limited to denial-of-service (device crash/loss of connectivity) - no code execution or data disclosure is indicated.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is strictly availability (VA:H) with VC:N/VI:N - a denial-of-service condition only, not code execution or data compromise. Despite CWE-121 (stack-based buffer overflow), the vendor and JPCERT describe only a DoS outcome, so the 8.7 score is driven entirely by easy remote reachability against a high-availability impact. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so exploitation is not confirmed. Consumer/SOHO Wi-Fi appliances like these are typically LAN-facing rather than internet-exposed, which further limits realistic attack surface. Net: a legitimate unauthenticated DoS on niche hardware - patch when convenient, but this is not an emergency.

An attacker with network reach to the device's web management interface (typically an adjacent/LAN position, or WAN if remote admin is exposed) sends a single crafted HTTP request that overflows a fixed-size stack buffer in the request-handling code. This crashes or hangs the router/extender, dropping connectivity until reboot. No public exploit code has been identified, and the demonstrated impact is denial-of-service only, not code execution.