ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration

ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration 1. Basic Information Article Title : Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026) Source : JVN Publication Date : July 28, 2026 Original URL : https://jvn.jp/jp/JVN56870912/index.html Related Source : ELECOM Notice (Linked from JVN) Related Entities : CVE-2026-44387 (Reflected XSS) CVE-2026-59764 (Management Screen OS Command Injection) CVE-2026-61376 (Configuration Restoration OS Command Injection) WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B Severity : Medium 2. Executive Summary An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network. 3. Attack Flow Chain A: Attacker Already Has Administrator Credentials The attacker reaches the management screen. The attacker logs in as an administrator. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376. Arbitrary commands execute on the device OS. Inference : Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion. Chain B: Reflected XSS An attacker on the same or an adjacent network prepares a crafted URL. The attacker tricks a user who can access the management screen into opening the URL. A script executes in the management screen origin via CVE-2026-44387. Inference : If a management session exists, it may chain into unintended management actions. 4. Attacker Position and Execution Location XSS requires adjacent network reachability and user interact