CVE-2026-95104: BUFFALO Wi-Fi Stack Overflow DoS Vulnerability

CVE-2026-95104 Overview

CVE-2026-95104 is a stack-based buffer overflow [CWE-121] affecting multiple BUFFALO Wi-Fi products. An unauthenticated attacker can send a crafted HTTP request to a vulnerable device and trigger a denial-of-service (DoS) condition. The flaw is reachable over the network without user interaction, which raises the risk for devices with management interfaces exposed to untrusted segments.

The vulnerability was coordinated through JPCERT/CC and published through the Japan Vulnerability Notes (JVN) portal. BUFFALO has issued a security notice for affected product lines.

Critical Impact
An unauthenticated remote attacker can crash the device with a single crafted HTTP request, disrupting wireless connectivity for all downstream clients.

Affected Products

BUFFALO Wi-Fi routers and access points identified in JVN advisory JVNVU#94863997
Specific model numbers and firmware versions enumerated in the Buffalo security notice dated 2026-09-28
Downstream BUFFALO-branded wireless products that share the vulnerable HTTP service component

Discovery Timeline

2026-09-28 - CVE-2026-95104 published to NVD
2026-09-28 - BUFFALO publishes security news bulletin
2026-09-28 - JVN Security Advisory JVNVU94863997 released
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-95104

Vulnerability Analysis

The vulnerability resides in the embedded HTTP server component used by BUFFALO Wi-Fi products for device management. The server fails to validate the length of attacker-controlled fields contained in HTTP requests before copying them into a fixed-size stack buffer. When the request exceeds the expected size, the copy operation overflows adjacent stack memory, corrupting the saved return address and causing the process to abort.

Because the HTTP service runs as a core component of the device, the crash forces a reboot or wedges the management plane. Clients associated with the access point lose connectivity until the device recovers. The attack requires no credentials, so any adversary who can reach the HTTP management port can trigger the condition.

Root Cause

The root cause is a classic stack-based buffer overflow [CWE-121]. The HTTP request parser uses an unbounded copy routine, likely strcpy or sprintf, against a stack-allocated buffer. No input length validation occurs before the write, and no stack canary or exploit mitigation stops the corruption from terminating the process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a single crafted HTTP request containing an oversized header, parameter, or URI to the device's management interface. The parser overflows its stack buffer and the HTTP service crashes, producing the denial-of-service condition described in the advisory.

Full exploitation details are available in the JVN Security Advisory JVNVU94863997 and the Buffalo Official Security News. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-95104

Indicators of Compromise

Unexpected reboots or watchdog resets of BUFFALO Wi-Fi devices with no corresponding administrative action
HTTP requests to the device management interface containing abnormally long headers, URIs, or form parameters
Loss of wireless client connectivity coinciding with inbound HTTP traffic from untrusted sources

Detection Strategies

Inspect network telemetry for HTTP requests to router management ports containing header or URI fields exceeding typical lengths
Alert on repeated TCP resets or connection failures to the device web interface, which indicate the service crashed
Correlate device syslog or SNMP trap data showing uptime resets with inbound HTTP traffic from the WAN or guest networks

Monitoring Recommendations

Forward device syslog and uptime counters to a centralized logging platform to detect anomalous reboots
Monitor WAN-side exposure of the HTTP and HTTPS management ports using external attack-surface scanning
Baseline normal HTTP management traffic volume and alert on deviations originating from unexpected source addresses

How to Mitigate CVE-2026-95104

Immediate Actions Required

Identify all BUFFALO Wi-Fi devices in the environment and cross-reference them against the model list in JVNVU#94863997
Restrict access to the device management HTTP interface to trusted administrative networks only
Disable remote WAN-side management if it is enabled on any affected device
Apply vendor firmware updates as soon as BUFFALO releases a fixed version for the affected model

Patch Information

BUFFALO has published guidance in the official security news bulletin. Administrators should consult that advisory for the firmware version containing the fix for each affected model and follow the standard BUFFALO firmware update procedure. Confirm the firmware version after the update and verify the device returns a non-vulnerable build string.

Workarounds

Block inbound TCP traffic to the device management ports (typically 80 and 443) at the perimeter firewall
Place affected devices on a management VLAN isolated from user and guest traffic
Use access control lists on upstream switches to restrict HTTP management access to specific administrator workstations

bash

# Example: restrict HTTP management access using iptables upstream of the device
iptables -A FORWARD -p tcp -d <router_ip> --dport 80 \
  -m iprange ! --src-range 10.0.0.10-10.0.0.20 -j DROP
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 \
  -m iprange ! --src-range 10.0.0.10-10.0.0.20 -j DROP