Refine your search

4 vulnerabilities found for WRC-BE72XSD-B by ELECOM CO.,LTD.

CVE-2026-42062 (GCVE-0-2026-42062)
Vulnerability from cvelistv5
Published
2026-05-13 12:01
Modified
2026-05-13 15:07
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Summary
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
References
Impacted products
Vendor Product Version
ELECOM CO.,LTD. WRC-BE72XSD-B Version: v1.1.1 and earlier
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42062",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:03.699043Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:12.520Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:52.127Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-42062",
    "datePublished": "2026-05-13T12:01:52.127Z",
    "dateReserved": "2026-05-07T05:47:07.064Z",
    "dateUpdated": "2026-05-13T15:07:12.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40621 (GCVE-0-2026-40621)
Vulnerability from cvelistv5
Published
2026-05-13 12:01
Modified
2026-05-13 15:07
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Summary
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
References
Impacted products
Vendor Product Version
ELECOM CO.,LTD. WRC-BE72XSD-B Version: v1.1.1 and earlier
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40621",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:07:35.372388Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:07:44.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Authentication Bypass Using an Alternate Path or Channel",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:41.873Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-40621",
    "datePublished": "2026-05-13T12:01:41.873Z",
    "dateReserved": "2026-05-07T05:46:57.272Z",
    "dateUpdated": "2026-05-13T15:07:44.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-35506 (GCVE-0-2026-35506)
Vulnerability from cvelistv5
Published
2026-05-13 12:01
Modified
2026-05-13 15:19
Severity ?
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Summary
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.
References
Impacted products
Vendor Product Version
ELECOM CO.,LTD. WRC-BE72XSD-B Version: v1.1.1 and earlier
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35506",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T15:18:08.928545Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T15:19:45.905Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-BE72XSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE72XSD-BA",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.1 and earlier"
            }
          ]
        },
        {
          "product": "WRC-BE65QSD-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        },
        {
          "product": "WRC-W702-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.1.0 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T12:01:30.798Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20260512-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN03037325/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2026-35506",
    "datePublished": "2026-05-13T12:01:30.798Z",
    "dateReserved": "2026-05-07T05:47:11.955Z",
    "dateUpdated": "2026-05-13T15:19:45.905Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

jvndb-2026-000073
Vulnerability from jvndb
Published
2026-05-12 15:16
Modified
2026-05-20 11:52
Severity ?
9.8 (Critical) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)
Details
Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/321.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/288.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/754.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/344.html' target='_blank'></a><ul><li>Use of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107</li><li>OS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506</li><li>Missing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621</li><li>OS command injection in processing of username parameter (CWE-78) - CVE-2026-42062</li><li>Stored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948</li><li>Missing Check for language parameter (CWE-754) - CVE-2026-42950</li><li>Inadequate CSRF protection (CWE-344) - CVE-2026-42961</li></ul>The vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer. CVE-2026-25107, CVE-2026-42950, CVE-2026-42961 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. CVE-2026-42948 Sato Nobuhiro of Suzuki Motor Corporation, Futamata Keisuke of University Of Fukui, Takahashi Natsuki of Shizuoka University, Sasaki Miyu of Waseda University, and Tsuyoshi Tomita of Ministry of Defense reported this vulnerability to IPA. CVE-2026-35506, CVE-2026-40621, CVE-2026-42062 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.
References
Impacted products
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000073.html",
  "dc:date": "2026-05-20T11:52+09:00",
  "dcterms:issued": "2026-05-12T15:16+09:00",
  "dcterms:modified": "2026-05-20T11:52+09:00",
  "description": "Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/321.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/288.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\r\n\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/754.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/344.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eUse of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107\u003c/li\u003e\u003cli\u003eOS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506\u003c/li\u003e\u003cli\u003eMissing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621\u003c/li\u003e\u003cli\u003eOS command injection in processing of username parameter (CWE-78) - CVE-2026-42062\u003c/li\u003e\u003cli\u003eStored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948\u003c/li\u003e\u003cli\u003eMissing Check for language parameter (CWE-754) - CVE-2026-42950\u003c/li\u003e\u003cli\u003eInadequate CSRF protection (CWE-344) - CVE-2026-42961\u003c/li\u003e\u003c/ul\u003eThe vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer.\r\n\r\nCVE-2026-25107, CVE-2026-42950, CVE-2026-42961\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\n\r\nCVE-2026-42948\r\nSato Nobuhiro of Suzuki Motor Corporation, Futamata Keisuke of University Of Fukui, Takahashi Natsuki of Shizuoka University, Sasaki Miyu of Waseda University, and Tsuyoshi Tomita of Ministry of Defense reported this vulnerability to IPA.\r\n\r\nCVE-2026-35506, CVE-2026-40621, CVE-2026-42062\r\nChuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000073.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:elecom:wab-be187-m",
      "@product": "WAB-BE187-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be36-m",
      "@product": "WAB-BE36-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be36-s",
      "@product": "WAB-BE36-S",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wab-be72-m",
      "@product": "WAB-BE72-M",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be65qsd-b",
      "@product": "WRC-BE65QSD-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be72xsd-b",
      "@product": "WRC-BE72XSD-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-be72xsd-ba",
      "@product": "WRC-BE72XSD-BA",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-w702-b",
      "@product": "WRC-W702-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gs-b_firmware",
      "@product": "WRC-X1800GS-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gsa-b_firmware",
      "@product": "WRC-X1800GSA-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1800gsh-b_firmware",
      "@product": "WRC-X1800GSH-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-b",
      "@product": "WRC-X3000GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-w",
      "@product": "WRC-X3000GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2a-b",
      "@product": "WRC-X3000GS2A-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gst2-b",
      "@product": "WRC-X3000GST2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000qs-g",
      "@product": "WRC-X6000QS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000qsa-g",
      "@product": "WRC-X6000QSA-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xs-g_firmware",
      "@product": "WRC-X6000XS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xst-g_firmware",
      "@product": "WRC-X6000XST-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-xe5400gs-g",
      "@product": "WRC-XE5400GS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-xe5400gsa-g",
      "@product": "WRC-XE5400GSA-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "9.8",
    "@severity": "Critical",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000073",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN03037325/index.html",
      "@id": "JVN#03037325",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-25107",
      "@id": "CVE-2026-25107",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-35506",
      "@id": "CVE-2026-35506",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-40621",
      "@id": "CVE-2026-40621",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42062",
      "@id": "CVE-2026-42062",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42948",
      "@id": "CVE-2026-42948",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42950",
      "@id": "CVE-2026-42950",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2026-42961",
      "@id": "CVE-2026-42961",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in ELECOM wireless LAN routers and access points (May 2026)"
}