VulnerabilityPublished 3 Feb 2026

CVE-2026-24449: ELECOM WRC-X1500GS-B · Use of Weak Credentials

Affects ELECOM WRC-X1500GS-BSource CVE Database V5

Not known to be exploited · CVSS 4.6 Medium.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.0 base score

4.6Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Physical
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Physical: The attack requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief or persistent.
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
ELECOM CO.,LTD.WRC-X1500GS-B	Affected =all versions	Fixed in–
ELECOM CO.,LTD.WRC-X1500GSA-B	Affected =all versions	Fixed in–

AI-suggested

Immediately change the default passwords on all affected ELECOM WRC-X1500GS-B and WRC-X1500GSA-B devices before deployment or as soon as possible if already deployed.
Implement network segmentation to isolate management interfaces from general user networks, limiting access to trusted administrators only.
Restrict physical and network access to the devices, using VLANs, firewalls, or access control lists to prevent unauthorized local network access.
Monitor network traffic for unusual access attempts to router management interfaces.
Regularly audit device configurations and credentials to ensure compliance with security policies.
Engage with ELECOM for firmware updates or patches addressing this vulnerability and apply them promptly once available.
Educate network administrators about the risks of weak default credentials and enforce strong password policies.
Consider replacing affected devices with alternatives that do not have this vulnerability if mitigation is not feasible.
Maintain an inventory of affected devices to ensure comprehensive coverage of mitigation efforts.

Description

CVE-2026-24449 is a medium-severity vulnerability affecting ELECOM CO. ,LTD. 's WRC-X1500GS-B and WRC-X1500GSA-B wireless routers. The issue arises because the initial device passwords can be easily derived from publicly available system information, enabling unauthorized access without user interaction or authentication. This vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation requires network access to the device but no prior privileges. There are no known exploits in the wild, and no patches have been published yet. European organizations using these devices risk unauthorized disclosure of sensitive network information. Mitigation involves changing default credentials immediately upon deployment and restricting network access to management interfaces. Countries with higher adoption of ELECOM networking hardware, particularly Japan's trading partners and countries with strong electronics import ties such as Germany, France, and the UK, are more likely to be affected.

Impact

For European organizations, this vulnerability poses a risk of unauthorized access to network devices, potentially leading to exposure of sensitive internal network information and configurations. While it does not directly compromise data integrity or availability, unauthorized access could facilitate further attacks such as network reconnaissance, man-in-the-middle attacks, or lateral movement within the network. Organizations relying on these ELECOM routers may face confidentiality breaches, especially if devices are deployed in sensitive environments or connected to critical infrastructure. The medium CVSS score reflects the limited attack vector (physical or local network access) but high confidentiality impact. The absence of known exploits reduces immediate risk but does not eliminate it. European entities with remote or unmanaged network segments using these devices are particularly vulnerable. The exposure could also affect compliance with data protection regulations like GDPR if personal data is indirectly compromised through network access.

Summary

CVE-2026-24449 is a vulnerability identified in ELECOM CO.,LTD.'s wireless router models WRC-X1500GS-B and WRC-X1500GSA-B. The core issue is the use of weak initial passwords that can be easily calculated from system information accessible on the device. This means an attacker with network access can derive the default credentials without needing prior authentication or user interaction. The vulnerability affects all versions of these products. According to the CVSS 3.0 vector, the attack requires physical or local network access (AV:P), has low attack complexity (AC:L), requires no privileges (PR:N), and no user interaction (UI:N). The impact is primarily on confidentiality (C:H), with no impact on integrity or availability. This weakness allows unauthorized parties to gain access to the router's management interface, potentially exposing sensitive network configuration and data. No patches or fixes have been released yet, and no exploits have been observed in the wild. The vulnerability is publicly disclosed and tracked by JPCERT, indicating recognition by the security community. Given the nature of the vulnerability, it is critical for users to change default passwords and implement network access controls to prevent unauthorized access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Feb 2026, 11:03 UTC

Technical details

References

Community reviews

Related threats