Medium severity · published Feb 3, 2026
CVE-2026-24449
For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WRC-X1500GS-B · ELECOM CO.,LTD.
all versions · source: vendor
WR
WRC-X1500GSA-B · ELECOM CO.,LTD.
all versions · source: vendor
WF
Wrc-x1500gs-b Firmware · Elecom
All versions, or not specified · source: NVD
WF
Wrc-x1500gsa-b Firmware · Elecom
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24449
Third Party Advisory
https://jvn.jp/en/jp/JVN94012927/
Vendor Advisory
https://www.elecom.co.jp/news/security/20260203-01/
More from WRC-X1500GS-B
8.8
CVE-2026-22550
OS command injection vulnerability exists in ELECOM wireless LAN products
8.8
CVE-2024-40883
Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers
6.8
CVE-2024-39607
OS command injection vulnerability exists in ELECOM wireless LAN routers
6.8
CVE-2024-22372
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a…
4.3
CVE-2026-20704
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products