ELECOM
Vulnerability activity for ELECOM: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 4.3MediumMay 13, 2026ELECOM WAB-BE187-M CSRFCVE-2026-42961ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.
- 4.3MediumMay 13, 2026ELECOM WAB-BE187-MCVE-2026-42950ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.
- 9.8CriticalMay 13, 2026ELECOM WRC-BE72XSD-B Code / command injectionCVE-2026-42062ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.1.6% likely
- 9.8CriticalMay 13, 2026ELECOM WRC-BE72XSD-B Auth bypass / access controlCVE-2026-40621ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
- 7.2HighMay 13, 2026ELECOM WRC-BE72XSD-B Code / command injectionCVE-2026-35506ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.1.3% likely
- 6.5MediumMay 13, 2026ELECOM WRC-X1800GS-B Crypto / certificateCVE-2026-25107ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.
Top products
- WRC-BE72XSD-B3 CVEs in the last year, 2 critical
- WAB-BE187-M2 CVEs in the last year
- WRC-X1800GS-B1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.