The ELECOM WRC-BE72XSD-B wireless LAN access point contains an OS command injection vulnerability due to improper neutralization of special elements in the ping_ip_addr parameter. This flaw allows a logged-in user to execute arbitrary operating system commands by sending a crafted request to the device. The issue affects firmware versions v1.1.1 and earlier. The CVSS v3.0 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows a logged-in user to execute arbitrary OS commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could disrupt network operations or allow further attacks within the network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device management interface to trusted users only and monitor for suspicious activity from authenticated users. Avoid using affected versions in sensitive environments if possible.