CVE-2026-42062: Command Injection in ELECOM WRC-BE72XSD-B

The impact of this vulnerability is severe. Due to the lack of authentication, any attacker can exploit this command injection by crafting a malicious request containing arbitrary commands. Successful exploitation grants the attacker complete control over the affected access point, enabling them to modify configurations, steal sensitive data (such as network credentials or user information stored on the device), install malware, and potentially pivot to other systems on the network. The absence of authentication significantly lowers the barrier to entry for attackers, making this a high-priority risk. This vulnerability shares similarities with other command injection flaws where attackers can bypass access controls and gain root-level privileges.

1. Reserviert2026-05-07
2. Veröffentlicht2026-05-13

Currently, no official patch is available from ELECOM. Until a patch is released, the primary mitigation strategy is to isolate the affected access points from external networks. Implement strict firewall rules to block all inbound traffic except for essential management ports. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the username parameter. Regularly monitor access point logs for suspicious activity, specifically looking for unusual command executions. If possible, temporarily disable remote management features to reduce the attack surface. After a patch is released, upgrade the access point firmware immediately and verify the fix by attempting to inject a simple command (e.g., whoami) via the username parameter; the command should not be executed.