Elecom vulnerabilities
We track 32 vulnerabilities in Elecom products across 60+ products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2026.
Latest Elecom vulnerabilities
- 8.6 High severity
WAB-M1775-PS: Improper Neutralization of Special Elements used in an OS Command
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- 8.6 High severity
WRC-X3000GS3-B: Improper Neutralization of Special Elements used in an OS Command
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
- 9.3 Critical severity
WRC-BE72XSD-B: Improper Neutralization of Special Elements used in an OS Command
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
- 9.3 Critical severity
WRC-BE72XSD-B: Authentication Bypass Using an Alternate Path or Channel
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
- 8.6 High severity
WRC-BE72XSD-B: Improper Neutralization of Special Elements used in an OS Command
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.
- 8.8 High severity
WRC-X6000XS-G: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution.
- 8.4 High severity
Clone for Windows: Unquoted Search Path or Element
Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
- 7.2 High severity
WRC-BE36QS-B: Improper Neutralization of Special Elements used in an OS Command
WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to WebGUI.
- 9.3 Critical severity
WRH-733GBK: Improper Neutralization of Special Elements used in an OS Command
WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in miniigd SOAP service. If a remote unauthenticated attacker sends a specially crafted request to the affected produc
- 9.3 Critical severity
WRH-733GBK: Improper Neutralization of Special Elements used in an OS Command
WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in the telnet function. If a remote unauthenticated attacker sends a specially crafted request to the affected product
- 8.7 High severity
WRC-X3000GS: Improper Neutralization of Special Elements used in an OS Command
WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request
- 9.8 Critical severity
WAB-I1750-PS: Out-of-bounds Write
Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.
- 8.8 High severity
WRC-X1500GS-B: Cross-Site Request Forgery
Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the l
- 8.8 High severity
WRC-X3200GST3-B: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially crafted request to the product. Affected products and versions are as follows: WRC-X320
- 8.8 High severity
WRC-1167GS2-B: Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note
- 8.0 High severity
WRC-X3000GS2-W: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlier allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a specially crafted reque
- 8.8 High severity
WAB-S600-PS: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
- 9.8 Critical severity
WRC-F1167ACF: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-F1167ACF all versions,
- 8.8 High severity
WRC-F1167ACF: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request.
- 8.8 High severity
WRC-600GHBK-A: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-600GHBK-A all versions, WRC-1467GHBK-A
- 8.8 High severity
LAN-WH300N/RE: Improper Control of Generation of Code
Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted file to the product's certain management console.
- 8.0 High severity
LAN-WH300N/RE: Improper Control of Generation of Code
Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arbitrary OS commands on a certain management console.
- 8.8 High severity
LAN-W451NGR: Improper Access Control
LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allows an unauthenticated attacker to log in to telnet service.
- 9.8 Critical severity
LAN-W300N/RS: Improper Control of Generation of Code
Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands.
- 8.0 High severity
WRC-1167GHBK-S: Improper Control of Generation of Code
Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-
- 8.0 High severity
WRC-1167GHBK-S: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: W
- 8.8 High severity
WTC-C1167GC-B: Cross-Site Request Forgery
Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed.
- 8.0 High severity
WRC-1167GHBK-S: Improper Neutralization of Special Elements used in a Command
ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page.
- 9.8 Critical severity
WRC-1167GHBK3-A: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versi
- 8.0 High severity
WRC-1167GHBK3-A: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as
- 7.3 High severity
WAB-MAT: Unquoted Search Path or Element
WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privileg
- 7.8 High severity
ELECOM Camera Assistant and QuickFileDealer: Untrusted Search Path
Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.