High severity · published Jul 28, 2026
CVE-2026-59764
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI
7.2
CVSS
1.7%
EPSS
No
On KEV
Description
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WRC-X3000GS3-B · ELECOM CO.,LTD.
through v1.06 · source: vendor
WR
WRC-X3000GS3A-B · ELECOM CO.,LTD.
through v1.06 · source: vendor