CVE-2024-26258 is an OS command injection vulnerability in ELECOM CO.,LTD. WRC-X3200GST3-B wireless LAN routers. An attacker with network adjacency and valid credentials can send a specially crafted request to execute arbitrary OS commands on the device. The issue affects firmware versions v1.25 and earlier. The CVSS v3.0 base score is 6.8, reflecting a medium severity with high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor. The vulnerability is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows an authenticated network-adjacent attacker to execute arbitrary OS commands on the affected router, potentially compromising the device's confidentiality, integrity, and availability. This could lead to unauthorized control over the device and disruption of network services. However, exploitation requires valid credentials, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interface to trusted users only and monitor for any unusual activity. Since exploitation requires valid credentials, ensure strong password policies and consider limiting administrative access to trusted networks. Follow up with ELECOM CO.,LTD. for any forthcoming security updates or patches.