CVE-2026-95104 in WSR-300HP
Summary
by MITRE • 09/28/2026
Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service (DoS) condition.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The identified security flaw represents a critical stack-based buffer overflow within the web server component of specific BUFFALO Wi-Fi networking devices. This type of vulnerability arises when the application fails to properly validate or bound-check user-supplied input before copying it into a fixed-size memory buffer located on the call stack. In this specific instance, the weakness is triggered by sending a crafted HTTP request that contains an oversized payload in one of its headers or parameters. Because the receiving function does not adequately verify the length of the incoming data against the allocated buffer size, the excess bytes overwrite adjacent memory locations on the stack. This overwriting corrupts critical control data such as return addresses and saved frame pointers, which are essential for maintaining the integrity of program execution flow during a function call sequence.
From an operational perspective, this vulnerability allows any unauthenticated actor to exploit the flaw remotely without requiring valid credentials or prior network access beyond basic connectivity to the device's management interface. The primary consequence is a denial-of-service condition where the web server process crashes due to memory corruption and invalid instruction pointer values. This crash results in the immediate cessation of all HTTP services provided by the router, effectively rendering the administrative interface inaccessible. While the initial impact observed is service disruption, stack-based buffer overflows carry inherent risks that extend beyond simple availability loss. If an attacker can precisely control the overwritten data, they may potentially achieve arbitrary code execution on the device's underlying operating system. This could allow for complete compromise of the network infrastructure, enabling lateral movement to other devices, interception of sensitive traffic, or establishment of persistent backdoors within the local area network.
The technical nature of this flaw aligns with Common Weakness Enumeration identifier CWE-121, which specifically denotes a stack-based buffer overflow caused by insufficient bounds checking on user-controlled input. Furthermore, in terms of tactical classification under the MITRE ATT&CK framework for IoT and embedded systems, this vulnerability facilitates initial access through exploitation of remote services that lack proper authentication mechanisms. The attack vector is classified as network-accessible with low complexity, allowing adversaries to launch automated attacks against vulnerable endpoints without needing complex setup or specific environmental conditions beyond reaching the target port.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution involves applying vendor-provided firmware updates that patch the buffer handling logic by implementing strict input validation and length checks before processing HTTP requests. If an update is not immediately available, network-level controls should be employed to restrict access to the device's management interface only from trusted IP addresses or isolated administrative VLANs. Additionally, deploying intrusion detection systems configured with signatures for known exploitation patterns of this specific buffer overflow can help identify and block malicious traffic attempts in real-time. For long-term resilience, manufacturers must adopt secure coding practices that enforce memory-safe programming standards and conduct rigorous static analysis to detect similar boundary-checking failures across their product line before deployment.