The ELECOM WRC-X1800GS-B device uses a hard-coded cryptographic key for encrypting backup configuration files. Knowledge of this key allows an attacker to tamper with configuration backups, which may then be loaded by an administrator, leading to unauthorized configuration changes. This vulnerability affects firmware versions v1.19 and earlier. The CVSS 3.0 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No official patch or vendor advisory is currently available.

An attacker who knows the hard-coded cryptographic key can modify backup configuration files. If an administrator is tricked into loading a crafted configuration file, the attacker can cause unauthorized changes to the device configuration, impacting the integrity of the device settings. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when restoring configuration files and verify the source and integrity of backup files before applying them. Avoid using backup files from untrusted sources.