CVE-2026-40621 is an authentication bypass vulnerability in ELECOM CO.,LTD.'s WRC-BE72XSD-B wireless LAN access point devices. The issue arises because some specific URLs on the device do not require authentication, enabling an attacker to access the device without credentials. This vulnerability affects firmware versions v1.1.1 and earlier. The CVSS v3.0 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and impacts to confidentiality, integrity, and availability. The vulnerability was published on May 13, 2026. No vendor advisory or patch information is currently available.

An attacker can bypass authentication controls and access sensitive device functions or data via specific URLs without credentials. This can lead to full compromise of the device, including unauthorized configuration changes, data disclosure, or denial of service. The critical CVSS score of 9.8 reflects the potential for complete system compromise remotely without any user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected device to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device management interface to untrusted networks.