CVE-2026-35506: Command Injection in ELECOM WRC-BE72XSD-B

The impact of this command injection vulnerability is significant. A successful attacker can gain complete control over the affected access point, enabling them to modify system configurations, steal sensitive data (including network credentials and user information), and potentially pivot to other devices on the network. The ability to execute arbitrary OS commands bypasses standard access controls, making it a highly dangerous vulnerability. Attackers could leverage this to establish a persistent presence on the network, conduct surveillance, or launch further attacks against internal resources. The blast radius extends beyond the access point itself, potentially impacting the entire network infrastructure.

1. Reserviert2026-05-07
2. Veröffentlicht2026-05-13

The primary mitigation for CVE-2026-35506 is to upgrade the ELECOM WRC-BE72XSD-B access point to a firmware version that addresses the vulnerability. ELECOM has not yet released a patch, so monitoring their website for updates is crucial. As a temporary workaround, consider restricting access to the management interface to trusted networks only, and implementing strict authentication policies. While not a complete solution, these measures can reduce the attack surface. If an upgrade is not immediately possible, consider temporarily disabling features that rely on the vulnerable parameter, though this may impact functionality. After applying a firmware update, verify the fix by attempting to inject a command through the pingipaddr parameter and confirming that it is rejected.