7.2
/ 10
HIGH
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.
Basic Information
ID
CVE-2026-35506
Source
jpcert
Published
May 13, 2026 at 12:01
Affected Product
Vendor
ELECOM CO.,LTD.
Product
WRC-BE72XSD-B
Version
v1.1.1 and earlier
Affected Versions
ELECOM CO.,LTD. WRC-BE72XSD-B v1.1.1 and earlier
ELECOM CO.,LTD. WRC-BE72XSD-BA v1.1.1 and earlier
ELECOM CO.,LTD. WRC-BE65QSD-B v1.1.0 and earlier
ELECOM CO.,LTD. WRC-W702-B v1.1.0 and earlier
ELECOM CO.,LTD. WRC-BE72XSD-BA v1.1.1 and earlier
ELECOM CO.,LTD. WRC-BE65QSD-B v1.1.0 and earlier
ELECOM CO.,LTD. WRC-W702-B v1.1.0 and earlier