CVE-2026-27650
Published: 27 March 2026
Summary
CVE-2026-27650 is a high-severity OS Command Injection (CWE-78) vulnerability in Buffalo Wcr-1166Dhpl Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27650 is an OS Command Injection vulnerability (CWE-78) present in BUFFALO Wi-Fi router products. Published on 2026-03-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. Exploitation enables attackers to execute arbitrary OS commands on the affected products.
The vulnerability is exploitable remotely over the network with low attack complexity, requiring no authentication or privileges and no user interaction. Successful attacks maintain an unchanged scope while achieving high impacts on confidentiality, integrity, and availability, potentially allowing full device compromise such as data theft, modification, or denial of service.
Advisories detailing mitigations and patches are available from JVN at https://jvn.jp/en/jp/JVN83788689/ and Buffalo at https://www.buffalo.jp/news/detail/20260323-01.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16543
Vulnerability details
OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may be executed on the products.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of public-facing router web interface (T1190) leading to arbitrary OS command execution via Unix shell (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly eliminates the OS command injection vulnerability by requiring timely flaw remediation through application of vendor-provided patches for the Buffalo Wi-Fi router.
Prevents arbitrary OS command execution by implementing input validation checks to sanitize untrusted network inputs to the vulnerable router functions.
Detects exploitation of the command injection vulnerability through monitoring of system activities, unauthorized connections, and indicators of attack on the router.