Buffalo WSR-300HP EUVD-2026-88165

Requires an authenticated administrative user of the BUFFALO web management interface (PR:H) who sends a crafted HTTP request to a web form field that is concatenated into an internal OS command string on the WSR-300HP router or WEX-G300 range extender. No end-user interaction beyond the attacker's own admin session is needed (UI:N), and the vector is network-reachable to the device's web UI. Exploitation is limited by the need for valid admin credentials or a session (e.g., via default/weak passwords or CSRF against a logged-in admin) and by the narrow, primarily-Japanese consumer/SOHO deployment of these specific models.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6, driven by full compromise impact once triggered, but the PR:H requirement is the dominant risk-limiting signal: exploitation requires an already-authenticated administrative user of the router's web interface. This is post-authentication command injection, not a pre-auth remote takeover, which sharply narrows the realistic threat to attackers who already hold admin credentials (default/weak passwords, CSRF against a logged-in admin, or an insider). No EPSS score, no CISA KEV listing, and no public POC are present in the available data - so there is no evidence of active exploitation or automated weaponization; this is a disclosed-but-not-yet-exploited issue. The 8.6 base score overstates day-to-day priority because the privilege gate makes it a targeted rather than mass-exploitable flaw. Note the underlying products are consumer/SOHO devices with a primarily Japanese footprint, further limiting broad enterprise exposure.

An attacker who has obtained administrative access to a BUFFALO WSR-300HP or WEX-G300 web console (via default/reused credentials or a CSRF trick against a logged-in admin) submits a crafted HTTP request to a web form whose input is concatenated into an internal OS command line. The unsanitized input breaks out of the intended command and executes arbitrary OS commands on the device. No public exploit code was identified at the time of analysis.