CVE-2026-22550 is an OS command injection vulnerability in ELECOM CO.,LTD.'s WRC-X6000XS-G wireless LAN product, affecting versions 1.12 and earlier. The flaw arises from improper neutralization of special elements in user-supplied input, enabling a logged-in user to execute arbitrary OS commands through crafted requests. The vulnerability has a CVSS 3.0 base score of 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows a logged-in user to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This can result in unauthorized control over the device and disruption of its normal operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interface to trusted users only and monitor for suspicious activity from logged-in users. Avoid exposing the device management interface to untrusted networks.