High severity · published Jul 28, 2026
CVE-2026-61376
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings
7.2
CVSS
1.7%
EPSS
No
On KEV
Description
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WAB-I1750-PS · ELECOM CO.,LTD.
through v2.0.5 · source: vendor
WA
WAB-M1775-PS · ELECOM CO.,LTD.
through v2.1.9 · source: vendor
WA
WAB-M2133 · ELECOM CO.,LTD.
through v2.0.5 · source: vendor
WA
WAB-S1167-PS · ELECOM CO.,LTD.
through v2.0.5 · source: vendor
WA
WAB-S1775 · ELECOM CO.,LTD.
through v2.1.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61376
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61376
jvn.jp
https://jvn.jp/en/jp/JVN56870912/
www.elecom.co.jp
https://www.elecom.co.jp/news/security/20260728-01/
More from WAB-I1750-PS
9.8
CVE-2024-43689
Stack-based buffer overflow vulnerability exists in ELECOM wireless access points
6.1
CVE-2024-42412
Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi
5.2
CVE-2026-44387
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI
3.7
CVE-2024-39300
Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier