CVE-2026-33280
Published: 27 March 2026
Summary
CVE-2026-33280 is a high-severity Hidden Functionality (CWE-912) vulnerability in Buffalo Wcr-1166Dhpl Firmware. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).
Deeper analysis
CVE-2026-33280 is a hidden functionality vulnerability (CWE-912) present in BUFFALO Wi-Fi router products. Published on 2026-03-27, it allows attackers to access the product's debugging functionality, which may result in the execution of arbitrary OS commands. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its potential for severe impact.
A remote attacker with network access can exploit this vulnerability without authentication, privileges, or user interaction. Exploitation involves low complexity and leads to high confidentiality, integrity, and availability impacts, enabling full compromise of the affected router through arbitrary OS command execution.
Advisories detailing mitigations and patches are available from JVN at https://jvn.jp/en/jp/JVN83788689/ and Buffalo at https://www.buffalo.jp/news/detail/20260323-01.html. Security practitioners should review these sources for specific firmware updates, configuration changes, or other remediation steps applicable to affected products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16549
Vulnerability details
Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing Wi-Fi router debugging functionality enables arbitrary OS command execution, directly mapping to Exploit Public-Facing Application (T1190) and Network Device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely remediation of flaws through firmware patching directly eliminates the hidden debugging functionality exploited for arbitrary OS command execution.
Configuring the router to disable non-essential debugging capabilities prevents unauthorized access to command execution features.
Identifying and prohibiting unauthenticated access to sensitive functions like debugging ensures no hidden capabilities are exploitable without authorization.