ELECOM Router CVEs: Reflected XSS and OS Command Injection Vulnerabilities

Vulnerability Overview Multiple vulnerabilities exist in ELECOM Wireless LAN routers and access points, including: 1. Reflected Cross-Site Scripting (CWE-79) in WebUI - CVE-2026-44387 - CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/SA:L/SL:SA/N Base Score 5.1 - CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:A/N Base Score 5.2 2. OS Command Injection (CWE-78) in WebUI - CVE-2026-59764 - CVSS 4.0: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VE:H/VA:H/SC:N/SE:N/SA:N Base Score 8.6 - CVSS 3.0: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Base Score 7.2 3. OS Command Injection (CWE-78) in Reset Settings - CVE-2026-61376 - CVSS 4.0: AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VE:H/VA:H/SC:N/SE:N/SA:N Base Score 8.6 - CVSS 3.0: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Base Score 7.2 Affected Impact Reflected Cross-Site Scripting (CVE-2026-44387): Arbitrary scripts may be executed in the web browsers of logged-in users. OS Command Injection (CVE-2026-59764, CVE-2026-61376): Attackers who can log in to the product may execute arbitrary OS commands. Remediation Update Firmware: According to information provided by the developer, update the firmware to the latest version. Affected Products CVE-2026-44387, CVE-2026-61376 - WAB-M1775-PS v2.1.9 and earlier versions - WAB-S1775 v2.1.9 and earlier versions - WAB-M2133 v2.0.5 and earlier versions - WAB-11750-PS v2.0.5 and earlier versions - WAB-S1167-PS v2.0.5 and earlier versions CVE-2026-59764 - WRC-X3000GS3-B v1.06 and earlier versions - WRC-X3000GS3A-B v1.06 and earlier versions Reference Information JPCERT/CC Addendum Vulnerability Analysis by JPCERT/CC Credits CVE-2026-44387: Reported to IPA by Kentarou Ishii of GMO Cybersecurity by Iera, Inc. JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. CVE-2026-59764: Reported to IPA by Hiromi Tanabe of Mitsui Bussan Secure Directions, Inc. JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. CVE-2026-61376: Reported to ELECOM CO.,LTD. by Rittai Kosawagi. Coordination was completed, and subsequently, ELECOM CO.,LTD. reported to JPCERT/CC to notify users of the solution via JVN. Additional Information JPCERT Alert JPCERT Reports CERT Advisory CPNI Advisory TRnotes CVE - CVE-2026-44387 - CVE-2026-59764 - CVE-2026-61376 JVN iPedia - JVNB-2026-000103 Copyright © 2000-2026 JPCERT/CC and IPA. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

ELECOM Router CVEs: Reflected XSS and OS Command Injection Vulnerabilities