Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-61376 (GCVE-0-2026-61376)

Vulnerability from nvd – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:08

Summary

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:08 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

5 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-M1775-PS	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-S1775	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-M2133	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-I1750-PS	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-S1167-PS	Affected: 0 , ≤ v2.0.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:08:24.631414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:08:35.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M1775-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1775",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M2133",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-I1750-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1167-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:42.075Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-61376",
    "datePublished": "2026-07-28T08:40:42.075Z",
    "dateReserved": "2026-07-13T01:43:55.012Z",
    "dateUpdated": "2026-07-28T16:08:35.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59764 (GCVE-0-2026-59764)

Vulnerability from nvd – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:08

Summary

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:08 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

2 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X3000GS3-B	Affected: 0 , ≤ v1.06 (semver)
ELECOM CO.,LTD.	WRC-X3000GS3A-B	Affected: 0 , ≤ v1.06 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:08:49.951700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:08:58.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WRC-X3000GS3-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v1.06",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WRC-X3000GS3A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v1.06",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:33.557Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-59764",
    "datePublished": "2026-07-28T08:40:33.557Z",
    "dateReserved": "2026-07-13T01:43:55.938Z",
    "dateUpdated": "2026-07-28T16:08:58.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44387 (GCVE-0-2026-44387)

Vulnerability from nvd – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:09

Summary

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Severity

5.2 (Medium)


                        
                          CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:09 UTC

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

5 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-M1775-PS	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-S1775	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-M2133	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-I1750-PS	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-S1167-PS	Affected: 0 , ≤ v2.0.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:09:09.769165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:09:18.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M1775-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1775",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M2133",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-I1750-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1167-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:21.004Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-44387",
    "datePublished": "2026-07-28T08:40:21.004Z",
    "dateReserved": "2026-07-13T01:43:56.796Z",
    "dateUpdated": "2026-07-28T16:09:18.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42961 (GCVE-0-2026-42961)

Vulnerability from nvd – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:04

Summary

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:03 UTC

CWE

CWE-344 - Use of Invariant Value in Dynamically Changing Context

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:03:53.658856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:04:39.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-344",
              "description": "Use of Invariant Value in Dynamically Changing Context",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:22.642Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42961",
    "datePublished": "2026-05-13T12:02:22.642Z",
    "dateReserved": "2026-05-07T05:47:12.897Z",
    "dateUpdated": "2026-05-13T15:04:39.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42950 (GCVE-0-2026-42950)

Vulnerability from nvd – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:05

Summary

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:05 UTC

CWE

CWE-754 - Improper check for unusual or exceptional conditions

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:05:24.135095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:05:49.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user\u0027s web browser may become broken."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper check for unusual or exceptional conditions",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:12.851Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42950",
    "datePublished": "2026-05-13T12:02:12.851Z",
    "dateReserved": "2026-05-07T05:47:10.836Z",
    "dateUpdated": "2026-05-13T15:05:49.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42948 (GCVE-0-2026-42948)

Vulnerability from nvd – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:06

Summary

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.

Severity

4.8 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:06 UTC

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:06:22.585437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:06:33.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:03.914Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42948",
    "datePublished": "2026-05-13T12:02:03.914Z",
    "dateReserved": "2026-05-07T05:47:09.922Z",
    "dateUpdated": "2026-05-13T15:06:33.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42062 (GCVE-0-2026-42062)

Vulnerability from nvd – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:07

Summary

ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:07 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:03.699043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:12.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:52.127Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42062",
    "datePublished": "2026-05-13T12:01:52.127Z",
    "dateReserved": "2026-05-07T05:47:07.064Z",
    "dateUpdated": "2026-05-13T15:07:12.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40621 (GCVE-0-2026-40621)

Vulnerability from nvd – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:07

Summary

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:07 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:35.372388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:44.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:41.873Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-40621",
    "datePublished": "2026-05-13T12:01:41.873Z",
    "dateReserved": "2026-05-07T05:46:57.272Z",
    "dateUpdated": "2026-05-13T15:07:44.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-35506 (GCVE-0-2026-35506)

Vulnerability from nvd – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:19

Summary

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:18 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:18:08.928545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:19:45.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:30.798Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-35506",
    "datePublished": "2026-05-13T12:01:30.798Z",
    "dateReserved": "2026-05-07T05:47:11.955Z",
    "dateUpdated": "2026-05-13T15:19:45.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25107 (GCVE-0-2026-25107)

Vulnerability from nvd – Published: 2026-05-13 12:01 – Updated: 2026-05-13 18:26

Summary

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 18:26 UTC

CWE

CWE-321 - Use of hard-coded cryptographic key

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

13 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: 1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:26:16.594153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:26:26.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Use of hard-coded cryptographic key",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:20.724Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-25107",
    "datePublished": "2026-05-13T12:01:20.724Z",
    "dateReserved": "2026-05-07T05:47:06.075Z",
    "dateUpdated": "2026-05-13T18:26:26.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24465 (GCVE-0-2026-24465)

Vulnerability from nvd – Published: 2026-02-03 06:57 – Updated: 2026-02-03 15:47

Summary

Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:47 UTC

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert

References

3 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://www.elecom.co.jp/news/security/20260203-02/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

6 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-S733IW2-PD	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S733IW-AC	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S733IW-PD	Affected: all versions
ELECOM CO.,LTD.	WAB-S300IW2-PD	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S300IW-AC	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S300IW-PD	Affected: all versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:47:14.941854Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:47:24.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-S733IW2-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S733IW-AC",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S733IW-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW2-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW-AC",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T06:57:51.704Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-02/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24465",
    "datePublished": "2026-02-03T06:57:51.704Z",
    "dateReserved": "2026-01-30T01:42:43.398Z",
    "dateUpdated": "2026-02-03T15:47:24.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24449 (GCVE-0-2026-24449)

Vulnerability from nvd – Published: 2026-02-03 06:57 – Updated: 2026-02-03 15:54

Summary

For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:53 UTC

CWE

CWE-1391 - Use of weak credentials

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

2 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: all versions
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: all versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:53:54.600516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:54:07.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "Use of weak credentials",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T06:57:20.505Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24449",
    "datePublished": "2026-02-03T06:57:20.505Z",
    "dateReserved": "2026-01-30T01:42:46.700Z",
    "dateUpdated": "2026-02-03T15:54:07.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22550 (GCVE-0-2026-22550)

Vulnerability from nvd – Published: 2026-02-03 06:56 – Updated: 2026-05-12 08:09

Summary

OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:55 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

15 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:55:01.293499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:55:14.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:09:24.537Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-22550",
    "datePublished": "2026-02-03T06:56:59.277Z",
    "dateReserved": "2026-01-30T01:42:48.683Z",
    "dateUpdated": "2026-05-12T08:09:24.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20704 (GCVE-0-2026-20704)

Vulnerability from nvd – Published: 2026-02-03 06:56 – Updated: 2026-05-12 08:09

Summary

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:55 UTC

CWE

CWE-352 - Cross-site request forgery (CSRF)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

15 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:55:57.052296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:56:26.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:09:07.849Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-20704",
    "datePublished": "2026-02-03T06:56:42.019Z",
    "dateReserved": "2026-01-30T01:42:47.600Z",
    "dateUpdated": "2026-05-12T08:09:07.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-61376 (GCVE-0-2026-61376)

Vulnerability from cvelistv5 – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:08

Summary

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:08 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

5 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-M1775-PS	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-S1775	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-M2133	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-I1750-PS	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-S1167-PS	Affected: 0 , ≤ v2.0.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61376",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:08:24.631414Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:08:35.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M1775-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1775",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M2133",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-I1750-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1167-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:42.075Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-61376",
    "datePublished": "2026-07-28T08:40:42.075Z",
    "dateReserved": "2026-07-13T01:43:55.012Z",
    "dateUpdated": "2026-07-28T16:08:35.015Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59764 (GCVE-0-2026-59764)

Vulnerability from cvelistv5 – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:08

Summary

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:08 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

2 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X3000GS3-B	Affected: 0 , ≤ v1.06 (semver)
ELECOM CO.,LTD.	WRC-X3000GS3A-B	Affected: 0 , ≤ v1.06 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59764",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:08:49.951700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:08:58.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WRC-X3000GS3-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v1.06",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WRC-X3000GS3A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v1.06",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:33.557Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-59764",
    "datePublished": "2026-07-28T08:40:33.557Z",
    "dateReserved": "2026-07-13T01:43:55.938Z",
    "dateUpdated": "2026-07-28T16:08:58.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-44387 (GCVE-0-2026-44387)

Vulnerability from cvelistv5 – Published: 2026-07-28 08:40 – Updated: 2026-07-28 16:09

Summary

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.

Severity

5.2 (Medium)


                        
                          CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 16:09 UTC

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260728-01/
https://jvn.jp/en/jp/JVN56870912/

Impacted products

5 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-M1775-PS	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-S1775	Affected: 0 , ≤ v2.1.9 (semver)
ELECOM CO.,LTD.	WAB-M2133	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-I1750-PS	Affected: 0 , ≤ v2.0.5 (semver)
ELECOM CO.,LTD.	WAB-S1167-PS	Affected: 0 , ≤ v2.0.5 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T16:09:09.769165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:09:18.061Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M1775-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1775",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.1.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-M2133",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-I1750-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WAB-S1167-PS",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "lessThanOrEqual": "v2.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T08:40:21.004Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260728-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN56870912/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-44387",
    "datePublished": "2026-07-28T08:40:21.004Z",
    "dateReserved": "2026-07-13T01:43:56.796Z",
    "dateUpdated": "2026-07-28T16:09:18.061Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42961 (GCVE-0-2026-42961)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:04

Summary

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:03 UTC

CWE

CWE-344 - Use of Invariant Value in Dynamically Changing Context

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:03:53.658856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:04:39.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-344",
              "description": "Use of Invariant Value in Dynamically Changing Context",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:22.642Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42961",
    "datePublished": "2026-05-13T12:02:22.642Z",
    "dateReserved": "2026-05-07T05:47:12.897Z",
    "dateUpdated": "2026-05-13T15:04:39.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42950 (GCVE-0-2026-42950)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:05

Summary

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:05 UTC

CWE

CWE-754 - Improper check for unusual or exceptional conditions

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42950",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:05:24.135095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:05:49.437Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user\u0027s web browser may become broken."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-754",
              "description": "Improper check for unusual or exceptional conditions",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:12.851Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42950",
    "datePublished": "2026-05-13T12:02:12.851Z",
    "dateReserved": "2026-05-07T05:47:10.836Z",
    "dateUpdated": "2026-05-13T15:05:49.437Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42948 (GCVE-0-2026-42948)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:02 – Updated: 2026-05-13 15:06

Summary

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.

Severity

4.8 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.8 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:06 UTC

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-BE187-M	Affected: v1.1.10 and earlier
ELECOM CO.,LTD.	WAB-BE72-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-M	Affected: v1.1.3 and earlier
ELECOM CO.,LTD.	WAB-BE36-S	Affected: v1.1.3 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42948",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:06:22.585437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:06:33.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-BE187-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.10 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE72-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-M",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        },
        {
          "product": "WAB-BE36-S",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.3 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:02:03.914Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42948",
    "datePublished": "2026-05-13T12:02:03.914Z",
    "dateReserved": "2026-05-07T05:47:09.922Z",
    "dateUpdated": "2026-05-13T15:06:33.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42062 (GCVE-0-2026-42062)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:07

Summary

ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:07 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:03.699043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:12.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:52.127Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42062",
    "datePublished": "2026-05-13T12:01:52.127Z",
    "dateReserved": "2026-05-07T05:47:07.064Z",
    "dateUpdated": "2026-05-13T15:07:12.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40621 (GCVE-0-2026-40621)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:07

Summary

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:07 UTC

CWE

CWE-288 - Authentication Bypass Using an Alternate Path or Channel

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:35.372388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:44.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:41.873Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-40621",
    "datePublished": "2026-05-13T12:01:41.873Z",
    "dateReserved": "2026-05-07T05:46:57.272Z",
    "dateUpdated": "2026-05-13T15:07:44.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-35506 (GCVE-0-2026-35506)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:01 – Updated: 2026-05-13 15:19

Summary

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 15:18 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

4 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-BE72XSD-B	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE72XSD-BA	Affected: v1.1.1 and earlier
ELECOM CO.,LTD.	WRC-BE65QSD-B	Affected: v1.1.0 and earlier
ELECOM CO.,LTD.	WRC-W702-B	Affected: v1.1.0 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:18:08.928545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:19:45.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:30.798Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-35506",
    "datePublished": "2026-05-13T12:01:30.798Z",
    "dateReserved": "2026-05-07T05:47:11.955Z",
    "dateUpdated": "2026-05-13T15:19:45.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25107 (GCVE-0-2026-25107)

Vulnerability from cvelistv5 – Published: 2026-05-13 12:01 – Updated: 2026-05-13 18:26

Summary

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-13 18:26 UTC

CWE

CWE-321 - Use of hard-coded cryptographic key

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

Impacted products

13 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: 1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25107",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:26:16.594153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:26:26.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "Use of hard-coded cryptographic key",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:20.724Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-25107",
    "datePublished": "2026-05-13T12:01:20.724Z",
    "dateReserved": "2026-05-07T05:47:06.075Z",
    "dateUpdated": "2026-05-13T18:26:26.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24465 (GCVE-0-2026-24465)

Vulnerability from cvelistv5 – Published: 2026-02-03 06:57 – Updated: 2026-02-03 15:47

Summary

Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:47 UTC

CWE

CWE-121 - Stack-based buffer overflow

Assigner

jpcert

References

3 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://www.elecom.co.jp/news/security/20260203-02/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

6 products

Vendor	Product	Version
ELECOM CO.,LTD.	WAB-S733IW2-PD	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S733IW-AC	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S733IW-PD	Affected: all versions
ELECOM CO.,LTD.	WAB-S300IW2-PD	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S300IW-AC	Affected: v5.5.00 and earlier versions
ELECOM CO.,LTD.	WAB-S300IW-PD	Affected: all versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:47:14.941854Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:47:24.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WAB-S733IW2-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S733IW-AC",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S733IW-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW2-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW-AC",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v5.5.00 and earlier versions"
            }
          ]
        },
        {
          "product": "WAB-S300IW-PD",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead to arbitrary code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based buffer overflow",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T06:57:51.704Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-02/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24465",
    "datePublished": "2026-02-03T06:57:51.704Z",
    "dateReserved": "2026-01-30T01:42:43.398Z",
    "dateUpdated": "2026-02-03T15:47:24.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-24449 (GCVE-0-2026-24449)

Vulnerability from cvelistv5 – Published: 2026-02-03 06:57 – Updated: 2026-02-03 15:54

Summary

For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:53 UTC

CWE

CWE-1391 - Use of weak credentials

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

2 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: all versions
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: all versions

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:53:54.600516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:54:07.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1391",
              "description": "Use of weak credentials",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-03T06:57:20.505Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-24449",
    "datePublished": "2026-02-03T06:57:20.505Z",
    "dateReserved": "2026-01-30T01:42:46.700Z",
    "dateUpdated": "2026-02-03T15:54:07.198Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-22550 (GCVE-0-2026-22550)

Vulnerability from cvelistv5 – Published: 2026-02-03 06:56 – Updated: 2026-05-12 08:09

Summary

OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution.

Severity

7.2 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:55 UTC

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

15 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22550",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:55:01.293499Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:55:14.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:09:24.537Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-22550",
    "datePublished": "2026-02-03T06:56:59.277Z",
    "dateReserved": "2026-01-30T01:42:48.683Z",
    "dateUpdated": "2026-05-12T08:09:24.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-20704 (GCVE-0-2026-20704)

Vulnerability from cvelistv5 – Published: 2026-02-03 06:56 – Updated: 2026-05-12 08:09

Summary

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-03 15:55 UTC

CWE

CWE-352 - Cross-site request forgery (CSRF)

Assigner

jpcert

References

2 references

URL	Tags
https://www.elecom.co.jp/news/security/20260203-01/
https://jvn.jp/en/jp/JVN94012927/

Impacted products

15 products

Vendor	Product	Version
ELECOM CO.,LTD.	WRC-X1500GS-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X1500GSA-B	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2-W	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GS2A-B	Affected: v1.09 and earlier
ELECOM CO.,LTD.	WRC-X3000GST2-B	Affected: v1.06 and earlier
ELECOM CO.,LTD.	WRC-X1800GS-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSA-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X1800GSH-B	Affected: v1.19 and earlier
ELECOM CO.,LTD.	WRC-X6000QS-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000QSA-G	Affected: v1.14 and earlier
ELECOM CO.,LTD.	WRC-X6000XS-G	Affected: v1.12 and earlier
ELECOM CO.,LTD.	WRC-X6000XST-G	Affected: v1.16 and earlier
ELECOM CO.,LTD.	WRC-XE5400GS-G	Affected: v1.13 and earlier
ELECOM CO.,LTD.	WRC-XE5400GSA-G	Affected: v1.13 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-03T15:55:57.052296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-03T15:56:26.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-X1500GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1500GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GS2A-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3000GST2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSA-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X1800GSH-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000QSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X6000XST-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GS-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "product": "WRC-XE5400GSA-G",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-12T08:09:07.849Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260203-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN94012927/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-20704",
    "datePublished": "2026-02-03T06:56:42.019Z",
    "dateReserved": "2026-01-30T01:42:47.600Z",
    "dateUpdated": "2026-05-12T08:09:07.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

JVNDB-2026-000103

Vulnerability from jvndb - Published: 2026-07-28 06:28 - Updated:2026-07-28 06:28

Severity

7.2 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in ELECOM wireless LAN routers and access points (July 2026)

Details

Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.

Reflected cross-site scripting in WebUI (CWE-79) - CVE-2026-44387
OS command injection in WebUI (CWE-78) - CVE-2026-59764
OS command injection in Restore Settings (CWE-78) - CVE-2026-61376

CVE-2026-44387 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-59764 Hirofumi Tanabe of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2026-61376 Rintaro Kawasugi reported this vulnerability to ELECOM CO.,LTD. and coordinated. After the coordination was completed, ELECOM CO.,LTD. reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN56870912/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-44387
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-59764
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-61376
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	ELECOM CO.,LTD.	WAB-I1750-PS
	ELECOM CO.,LTD.	WAB-S1167-PS
	ELECOM CO.,LTD.	WAB-M1775-PS
	ELECOM CO.,LTD.	WAB-M2133
	ELECOM CO.,LTD.	WAB-S1775
	ELECOM CO.,LTD.	WRC-X3000GS3-B
	ELECOM CO.,LTD.	WRC-X3000GS3A-B

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000103.html",
  "dc:date": "2026-07-28T15:28+09:00",
  "dcterms:issued": "2026-07-28T15:28+09:00",
  "dcterms:modified": "2026-07-28T15:28+09:00",
  "description": "Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eReflected cross-site scripting in WebUI (CWE-79) - CVE-2026-44387\u003c/li\u003e\u003cli\u003eOS command injection in WebUI (CWE-78) - CVE-2026-59764\u003c/li\u003e\u003cli\u003eOS command injection in Restore Settings (CWE-78) - CVE-2026-61376\u003c/li\u003e\u003c/ul\u003eCVE-2026-44387\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2026-59764\r\nHirofumi Tanabe of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2026-61376\r\nRintaro Kawasugi reported this vulnerability to ELECOM CO.,LTD. and coordinated. After the coordination was completed, ELECOM CO.,LTD. reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000103.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:elecom:wab-i1750-ps",
      "@product": "WAB-I1750-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:elecom:wab-s1167-ps",
      "@product": "WAB-S1167-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-m1775-ps",
      "@product": "WAB-M1775-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-m2133",
      "@product": "WAB-M2133",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-s1775",
      "@product": "WAB-S1775",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs3-b",
      "@product": "WRC-X3000GS3-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs3a-b",
      "@product": "WRC-X3000GS3A-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.2",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000103",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN56870912/index.html",
      "@id": "JVN#56870912",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-44387",
      "@id": "CVE-2026-44387",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-59764",
      "@id": "CVE-2026-59764",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-61376",
      "@id": "CVE-2026-61376",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in ELECOM wireless LAN routers and access points (July 2026)"
}

JVNDB-2026-000073

Vulnerability from jvndb - Published: 2026-05-12 06:16 - Updated:2026-07-29 06:19

Severity

9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)

Details

Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.

Use of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107
OS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506
Missing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621
OS command injection in processing of username parameter (CWE-78) - CVE-2026-42062
Stored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948
Missing Check for language parameter (CWE-754) - CVE-2026-42950
Inadequate CSRF protection (CWE-344) - CVE-2026-42961

The vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer. CVE-2026-25107, CVE-2026-42950, CVE-2026-42961 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. CVE-2026-42948 Sato Nobuhiro of Suzuki Motor Corporation, Futamata Keisuke of University Of Fukui, Takahashi Natsuki of Shizuoka University, Sasaki Miyu of Waseda University, and Tsuyoshi Tomita of Ministry of Defense reported this vulnerability to IPA. CVE-2026-35506, CVE-2026-40621, CVE-2026-42062 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN03037325/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-25107
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-35506
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-40621
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-42062
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-42948
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-42950
	CVE	https://www.cve.org/CVERecord?id=CVE-2026-42961
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

	ELECOM CO.,LTD.	WAB-I1750-PS
	ELECOM CO.,LTD.	WAB-S1167-PS
	ELECOM CO.,LTD.	WAB-BE187-M
	ELECOM CO.,LTD.	WAB-BE36-M
	ELECOM CO.,LTD.	WAB-BE36-S
	ELECOM CO.,LTD.	WAB-BE72-M
	ELECOM CO.,LTD.	WAB-M1775-PS
	ELECOM CO.,LTD.	WAB-M2133
	ELECOM CO.,LTD.	WAB-S1775
	ELECOM CO.,LTD.	WRC-BE65QSD-B
	ELECOM CO.,LTD.	WRC-BE72XSD-B
	ELECOM CO.,LTD.	WRC-BE72XSD-BA
	ELECOM CO.,LTD.	WRC-W702-B
	ELECOM CO.,LTD.	WRC-X1800GS-B
	ELECOM CO.,LTD.	WRC-X1800GSA-B
	ELECOM CO.,LTD.	WRC-X1800GSH-B
	ELECOM CO.,LTD.	WRC-X3000GS2-B
	ELECOM CO.,LTD.	WRC-X3000GS2-W
	ELECOM CO.,LTD.	WRC-X3000GS2A-B
	ELECOM CO.,LTD.	WRC-X3000GST2-B
	ELECOM CO.,LTD.	WRC-X6000QS-G
	ELECOM CO.,LTD.	WRC-X6000QSA-G
	ELECOM CO.,LTD.	WRC-X6000XS-G
	ELECOM CO.,LTD.	WRC-X6000XST-G
	ELECOM CO.,LTD.	WRC-XE5400GS-G
	ELECOM CO.,LTD.	WRC-XE5400GSA-G

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000073.html",
  "dc:date": "2026-07-29T15:19+09:00",
  "dcterms:issued": "2026-05-12T15:16+09:00",
  "dcterms:modified": "2026-07-29T15:19+09:00",
  "description": "Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/321.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/288.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/754.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/344.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eUse of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107\u003c/li\u003e\u003cli\u003eOS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506\u003c/li\u003e\u003cli\u003eMissing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621\u003c/li\u003e\u003cli\u003eOS command injection in processing of username parameter (CWE-78) - CVE-2026-42062\u003c/li\u003e\u003cli\u003eStored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948\u003c/li\u003e\u003cli\u003eMissing Check for language parameter (CWE-754) - CVE-2026-42950\u003c/li\u003e\u003cli\u003eInadequate CSRF protection (CWE-344) - CVE-2026-42961\u003c/li\u003e\u003c/ul\u003eThe vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer.\r\n\r\nCVE-2026-25107, CVE-2026-42950, CVE-2026-42961\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\n\r\nCVE-2026-42948\r\nSato Nobuhiro of Suzuki Motor Corporation, Futamata Keisuke of University Of Fukui, Takahashi Natsuki of Shizuoka University, Sasaki Miyu of Waseda University, and Tsuyoshi Tomita of Ministry of Defense reported this vulnerability to IPA.\r\n\r\nCVE-2026-35506, CVE-2026-40621, CVE-2026-42062\r\nChuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000073.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:elecom:wab-i1750-ps",
      "@product": "WAB-I1750-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:elecom:wab-s1167-ps",
      "@product": "WAB-S1167-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be187-m",
      "@product": "WAB-BE187-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be36-m",
      "@product": "WAB-BE36-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be36-s",
      "@product": "WAB-BE36-S",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be72-m",
      "@product": "WAB-BE72-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-m1775-ps",
      "@product": "WAB-M1775-PS",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-m2133",
      "@product": "WAB-M2133",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-s1775",
      "@product": "WAB-S1775",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be65qsd-b",
      "@product": "WRC-BE65QSD-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be72xsd-b",
      "@product": "WRC-BE72XSD-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be72xsd-ba",
      "@product": "WRC-BE72XSD-BA",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-w702-b",
      "@product": "WRC-W702-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gs-b_firmware",
      "@product": "WRC-X1800GS-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gsa-b_firmware",
      "@product": "WRC-X1800GSA-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gsh-b_firmware",
      "@product": "WRC-X1800GSH-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-b",
      "@product": "WRC-X3000GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-w",
      "@product": "WRC-X3000GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2a-b",
      "@product": "WRC-X3000GS2A-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gst2-b",
      "@product": "WRC-X3000GST2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000qs-g",
      "@product": "WRC-X6000QS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000qsa-g",
      "@product": "WRC-X6000QSA-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xs-g_firmware",
      "@product": "WRC-X6000XS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xst-g_firmware",
      "@product": "WRC-X6000XST-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-xe5400gs-g",
      "@product": "WRC-XE5400GS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-xe5400gsa-g",
      "@product": "WRC-XE5400GSA-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "9.8",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000073",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN03037325/index.html",
      "@id": "JVN#03037325",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25107",
      "@id": "CVE-2026-25107",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-35506",
      "@id": "CVE-2026-35506",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40621",
      "@id": "CVE-2026-40621",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42062",
      "@id": "CVE-2026-42062",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42948",
      "@id": "CVE-2026-42948",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42950",
      "@id": "CVE-2026-42950",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42961",
      "@id": "CVE-2026-42961",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

195 vulnerabilities by ELECOM CO.,LTD.

CVE-2026-61376 (GCVE-0-2026-61376)

CVE-2026-59764 (GCVE-0-2026-59764)

CVE-2026-44387 (GCVE-0-2026-44387)

CVE-2026-42961 (GCVE-0-2026-42961)

CVE-2026-42950 (GCVE-0-2026-42950)

CVE-2026-42948 (GCVE-0-2026-42948)

CVE-2026-42062 (GCVE-0-2026-42062)

CVE-2026-40621 (GCVE-0-2026-40621)

CVE-2026-35506 (GCVE-0-2026-35506)

CVE-2026-25107 (GCVE-0-2026-25107)

CVE-2026-24465 (GCVE-0-2026-24465)

CVE-2026-24449 (GCVE-0-2026-24449)

CVE-2026-22550 (GCVE-0-2026-22550)

CVE-2026-20704 (GCVE-0-2026-20704)

CVE-2026-61376 (GCVE-0-2026-61376)

CVE-2026-59764 (GCVE-0-2026-59764)

CVE-2026-44387 (GCVE-0-2026-44387)

CVE-2026-42961 (GCVE-0-2026-42961)

CVE-2026-42950 (GCVE-0-2026-42950)

CVE-2026-42948 (GCVE-0-2026-42948)

CVE-2026-42062 (GCVE-0-2026-42062)

CVE-2026-40621 (GCVE-0-2026-40621)

CVE-2026-35506 (GCVE-0-2026-35506)

CVE-2026-25107 (GCVE-0-2026-25107)

CVE-2026-24465 (GCVE-0-2026-24465)

CVE-2026-24449 (GCVE-0-2026-24449)

CVE-2026-22550 (GCVE-0-2026-22550)

CVE-2026-20704 (GCVE-0-2026-20704)

JVNDB-2026-000103

JVNDB-2026-000073

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

195 vulnerabilities by ELECOM CO.,LTD.

CVE-2026-61376 (GCVE-0-2026-61376)

CVE-2026-59764 (GCVE-0-2026-59764)

CVE-2026-44387 (GCVE-0-2026-44387)

CVE-2026-42961 (GCVE-0-2026-42961)

CVE-2026-42950 (GCVE-0-2026-42950)

CVE-2026-42948 (GCVE-0-2026-42948)

CVE-2026-42062 (GCVE-0-2026-42062)

CVE-2026-40621 (GCVE-0-2026-40621)

CVE-2026-35506 (GCVE-0-2026-35506)

CVE-2026-25107 (GCVE-0-2026-25107)

CVE-2026-24465 (GCVE-0-2026-24465)

CVE-2026-24449 (GCVE-0-2026-24449)

CVE-2026-22550 (GCVE-0-2026-22550)

CVE-2026-20704 (GCVE-0-2026-20704)

CVE-2026-61376 (GCVE-0-2026-61376)

CVE-2026-59764 (GCVE-0-2026-59764)

CVE-2026-44387 (GCVE-0-2026-44387)

CVE-2026-42961 (GCVE-0-2026-42961)

CVE-2026-42950 (GCVE-0-2026-42950)

CVE-2026-42948 (GCVE-0-2026-42948)

CVE-2026-42062 (GCVE-0-2026-42062)

CVE-2026-40621 (GCVE-0-2026-40621)

CVE-2026-35506 (GCVE-0-2026-35506)

CVE-2026-25107 (GCVE-0-2026-25107)

CVE-2026-24465 (GCVE-0-2026-24465)

CVE-2026-24449 (GCVE-0-2026-24449)

CVE-2026-22550 (GCVE-0-2026-22550)

CVE-2026-20704 (GCVE-0-2026-20704)

JVNDB-2026-000103

JVNDB-2026-000073

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.