ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.
ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.
ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.
Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.
ELECOM CO. ,LTD. WRC-X1800GS-B wireless LAN access points use a hard-coded cryptographic key for encrypting configuration file backups. An attacker who knows this key can modify a configuration file and potentially trick an administrator into applying a malicious configuration. This vulnerability affects versions v1.19 and earlier. The CVSS score is 6.5, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-24465 is a critical stack-based buffer overflow vulnerability in ELECOM CO. ,LTD. 's WAB-S733IW2-PD wireless LAN access point devices, affecting firmware versions v5.5.00 and earlier. This vulnerability allows an unauthenticated attacker to send a specially crafted packet to the device, leading to arbitrary code execution without any user interaction. The flaw impacts confidentiality, integrity, and availability, with a CVSS score of 9.8 indicating critical severity. Although no known exploits are currently observed in the wild, the ease of exploitation and potential impact make this a significant threat. European organizations using these access points could face severe network compromise, data breaches, or denial of service.
CVE-2026-24449 is a medium-severity vulnerability affecting ELECOM CO. ,LTD. 's WRC-X1500GS-B and WRC-X1500GSA-B wireless routers. The issue arises because the initial device passwords can be easily derived from publicly available system information, enabling unauthorized access without user interaction or authentication. This vulnerability impacts confidentiality but does not affect integrity or availability. Exploitation requires network access to the device but no prior privileges. There are no known exploits in the wild, and no patches have been published yet. European organizations using these devices risk unauthorized disclosure of sensitive network information. Mitigation involves changing default credentials immediately upon deployment and restricting network access to management interfaces. Countries with higher adoption of ELECOM networking hardware, particularly Japan's trading partners and countries with strong electronics import ties such as Germany, France, and the UK, are more likely to be affected.
OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution.
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
Clone for Windows provided by ELECOM CO.,LTD.registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remote attacker who can log in to WebGUI.
WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.
WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in miniigd SOAP service. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet function. If a remote unauthenticated attacker sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. If exploited, an arbitrary script may be executed on the web browser of the user who accessed WebGUI of the product.
