Buffalo Wzr-900dhp Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Buffalo Wzr-900dhp Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (10)

• CVE-2026-33280 — CVSS 9.8 (critical): Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging…
• CVE-2026-32669 — CVSS 9.8 (critical): Code injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary code may be executed…
• CVE-2026-27650 — CVSS 9.8 (critical): OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. If this vulnerability is exploited, an arbitrary OS command may…
• CVE-2022-40966 — CVSS 8.8 (high): Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and…
• CVE-2016-4815 — CVSS 7.5 (high): Directory traversal vulnerability on BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices with firmware 2.16…
• CVE-2026-32678 — CVSS 7.5 (high): Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to alter critical configuration settings…
• CVE-2022-39044 — CVSS 6.8 (medium): Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege…
• CVE-2022-34840 — CVSS 6.5 (medium): Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration…
• CVE-2016-4816 — CVSS 6.5 (medium): BUFFALO WZR-600DHP3 devices with firmware 2.16 and earlier and WZR-S600DHP devices allow remote attackers to discover credentials and other…
• CVE-2026-33366 — CVSS 5.3 (medium): Missing authentication for critical function vulnerability in BUFFALO Wi-Fi router products may allow an attacker to forcibly reboot the…