Critical severity · published May 13, 2026
CVE-2026-40621
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WRC-BE65QSD-B · ELECOM CO.,LTD.
v1.1.0 and earlier · source: vendor
WR
WRC-BE72XSD-B · ELECOM CO.,LTD.
v1.1.1 and earlier · source: vendor
WR
WRC-BE72XSD-BA · ELECOM CO.,LTD.
v1.1.1 and earlier · source: vendor
WR
WRC-W702-B · ELECOM CO.,LTD.
v1.1.0 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40621
jvn.jp
https://jvn.jp/en/jp/JVN03037325/
www.elecom.co.jp
https://www.elecom.co.jp/news/security/20260512-01/
More from WRC-BE65QSD-B
9.8
CVE-2026-42062
ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter
7.2
CVE-2026-35506
ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter