CVE-2026-59764 | ELECOM wireless LAN routers and access points devices contai… | CVSS 8.6 HIGH

Description

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

Metadata

CVE ID: CVE-2026-59764
State: PUBLISHED
Assigner: jpcert
Reserved: 2026-07-13 01:43 UTC
Published: 2026-07-28 08:40 UTC
Last updated: 2026-07-28 16:08 UTC
Primary CWE: CWE-78
Improper neutralization of special elements used in an OS co…
Vendor / Product: ELECOM CO.,LTD. / WRC-X3000GS3-B
Sources: cve.org · NVD

Severity & Metrics

8.6 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (2)

Vendor	Product	Platform	Versions
ELECOM CO.,LTD.	WRC-X3000GS3-B	—	0 ≤ v1.06
ELECOM CO.,LTD.	WRC-X3000GS3A-B	—	0 ≤ v1.06

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	Improper neutralization of special elements used in an OS command ('OS Command Injection')

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.6	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.2	HIGH	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References (2)