# cve.now: Elecom Co.,ltd.

The newest entries naming Elecom Co.,ltd. as an affected vendor (up to 200), of 84 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61376](https://cve.now/CVE-2026-61376.md): ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. (CVSS 7.2)
- [CVE-2026-59764](https://cve.now/CVE-2026-59764.md): ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. (CVSS 7.2)
- [CVE-2026-44387](https://cve.now/CVE-2026-44387.md): ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. (CVSS 5.2)
- [CVE-2026-42961](https://cve.now/CVE-2026-42961.md): ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. (CVSS 4.3)
- [CVE-2026-42950](https://cve.now/CVE-2026-42950.md): ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. (CVSS 4.3)
- [CVE-2026-42948](https://cve.now/CVE-2026-42948.md): Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. (CVSS 4.8)
- [CVE-2026-42062](https://cve.now/CVE-2026-42062.md): ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. (CVSS 9.8)
- [CVE-2026-40621](https://cve.now/CVE-2026-40621.md): ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. (CVSS 9.8)
- [CVE-2026-35506](https://cve.now/CVE-2026-35506.md): ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping\_ip\_addr parameter. (CVSS 7.2)
- [CVE-2026-25107](https://cve.now/CVE-2026-25107.md): ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. (CVSS 6.5)
- [CVE-2026-24465](https://cve.now/CVE-2026-24465.md): Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. (CVSS 9.8)
- [CVE-2026-24449](https://cve.now/CVE-2026-24449.md): For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information. (CVSS 4.6)
- [CVE-2026-22550](https://cve.now/CVE-2026-22550.md): OS command injection vulnerability exists in ELECOM wireless LAN products. (CVSS 7.2)
- [CVE-2026-20704](https://cve.now/CVE-2026-20704.md): Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. (CVSS 4.3)
- [CVE-2025-66271](https://cve.now/CVE-2025-66271.md): Clone for Windows provided by ELECOM CO.,LTD. (CVSS 6.7)
- [CVE-2025-46267](https://cve.now/CVE-2025-46267.md): Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. (CVSS 4.9)
- [CVE-2025-53472](https://cve.now/CVE-2025-53472.md): WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabil (CVSS 7.2)
- [CVE-2025-48890](https://cve.now/CVE-2025-48890.md): WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilit (CVSS 9.8)
- [CVE-2025-43879](https://cve.now/CVE-2025-43879.md): WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilit (CVSS 9.8)
- [CVE-2025-43877](https://cve.now/CVE-2025-43877.md): WRC-1167GHBK2-S contains a stored cross-site scripting vulnerability in WebGUI. (CVSS 5.4)
- [CVE-2025-41427](https://cve.now/CVE-2025-41427.md): WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command ('OS Command Inject (CVSS 8.8)
- [CVE-2025-36519](https://cve.now/CVE-2025-36519.md): Unrestricted upload of file with dangerous type issue exists in WRC-2533GST2, WRC-1167GST2, WRC-2533GST2, WRC-2533GS2V-B,WRC-2533GS2-B v1.69 (CVSS 4.3)
- [CVE-2024-43689](https://cve.now/CVE-2024-43689.md): Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. (CVSS 8.8)
- [CVE-2024-39300](https://cve.now/CVE-2024-39300.md): Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. (CVSS 8.1)
- [CVE-2024-34577](https://cve.now/CVE-2024-34577.md): Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing (CVSS 4.6)
- [CVE-2024-42412](https://cve.now/CVE-2024-42412.md): Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. (CVSS 6.1)
- [CVE-2024-40883](https://cve.now/CVE-2024-40883.md): Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.5)
- [CVE-2024-39607](https://cve.now/CVE-2024-39607.md): OS command injection vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.8)
- [CVE-2024-34021](https://cve.now/CVE-2024-34021.md): Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. (CVSS 6.8)
- [CVE-2024-36103](https://cve.now/CVE-2024-36103.md): OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent at (CVSS 6.8)
- [CVE-2024-29225](https://cve.now/CVE-2024-29225.md): ELECOM wireless LAN routers allow a network-adjacent unauthenticated attacker to obtain the configuration file containing sensitive informat (CVSS 4.3)
- [CVE-2024-26258](https://cve.now/CVE-2024-26258.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary O (CVSS 6.8)
- [CVE-2024-25568](https://cve.now/CVE-2024-25568.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS (CVSS 8.8)
- [CVE-2024-25579](https://cve.now/CVE-2024-25579.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exe (CVSS 6.8)
- [CVE-2024-23910](https://cve.now/CVE-2024-23910.md): Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated att (CVSS 4.3)
- [CVE-2024-21798](https://cve.now/CVE-2024-21798.md): ELECOM wireless LAN routers contain a cross-site scripting vulnerability. (CVSS 4.8)
- [CVE-2024-22372](https://cve.now/CVE-2024-22372.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exe (CVSS 6.8)
- [CVE-2023-49695](https://cve.now/CVE-2023-49695.md): OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a ne (CVSS 6.8)
- [CVE-2023-43752](https://cve.now/CVE-2023-43752.md): OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earl (no CVSS)
- [CVE-2023-43757](https://cve.now/CVE-2023-43757.md): Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. (no CVSS)
- [CVE-2023-40072](https://cve.now/CVE-2023-40072.md): OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS comma (CVSS 8.8)
- [CVE-2023-40069](https://cve.now/CVE-2023-40069.md): OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS c (CVSS 9.8)
- [CVE-2023-39944](https://cve.now/CVE-2023-39944.md): OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the product (no CVSS)
- [CVE-2023-39455](https://cve.now/CVE-2023-39455.md): OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending (no CVSS)
- [CVE-2023-39454](https://cve.now/CVE-2023-39454.md): Buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to execute arbitrary code. (CVSS 8.8)
- [CVE-2023-37565](https://cve.now/CVE-2023-37565.md): Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by se (no CVSS)
- [CVE-2023-37564](https://cve.now/CVE-2023-37564.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary O (no CVSS)
- [CVE-2023-37563](https://cve.now/CVE-2023-37563.md): ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtai (no CVSS)
- [CVE-2023-37562](https://cve.now/CVE-2023-37562.md): Cross-site request forgery (CSRF) vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. (no CVSS)
- [CVE-2023-37568](https://cve.now/CVE-2023-37568.md): ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated at (no CVSS)
- [CVE-2023-37567](https://cve.now/CVE-2023-37567.md): Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary (no CVSS)
- [CVE-2023-37566](https://cve.now/CVE-2023-37566.md): Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an ar (no CVSS)
- [CVE-2023-37561](https://cve.now/CVE-2023-37561.md): Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to red (no CVSS)
- [CVE-2023-37560](https://cve.now/CVE-2023-37560.md): Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attack (no CVSS)
- [CVE-2023-22282](https://cve.now/CVE-2023-22282.md): WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. (CVSS 7.3)
- [CVE-2023-22368](https://cve.now/CVE-2023-22368.md): Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain pri (CVSS 7.8)
- [CVE-2022-25915](https://cve.now/CVE-2022-25915.md): Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, (no CVSS)
- [CVE-2022-21799](https://cve.now/CVE-2022-21799.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network (no CVSS)
- [CVE-2022-21173](https://cve.now/CVE-2022-21173.md): Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH- (no CVSS)
- [CVE-2021-20864](https://cve.now/CVE-2021-20864.md): Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC- (no CVSS)
- [CVE-2021-20863](https://cve.now/CVE-2021-20863.md): OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-116 (no CVSS)
- [CVE-2021-20862](https://cve.now/CVE-2021-20862.md): Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC- (no CVSS)
- [CVE-2021-20861](https://cve.now/CVE-2021-20861.md): Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, (no CVSS)
- [CVE-2021-20860](https://cve.now/CVE-2021-20860.md): Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 a (no CVSS)
- [CVE-2021-20859](https://cve.now/CVE-2021-20859.md): ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, W (no CVSS)
- [CVE-2021-20858](https://cve.now/CVE-2021-20858.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to in (no CVSS)
- [CVE-2021-20857](https://cve.now/CVE-2021-20857.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to in (no CVSS)
- [CVE-2021-20856](https://cve.now/CVE-2021-20856.md): Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) a (no CVSS)
- [CVE-2021-20855](https://cve.now/CVE-2021-20855.md): Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) a (no CVSS)
- [CVE-2021-20854](https://cve.now/CVE-2021-20854.md): ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with (no CVSS)
- [CVE-2021-20853](https://cve.now/CVE-2021-20853.md): ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with (no CVSS)
- [CVE-2021-20852](https://cve.now/CVE-2021-20852.md): Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows (no CVSS)
- [CVE-2021-20739](https://cve.now/CVE-2021-20739.md): WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all v (no CVSS)
- [CVE-2021-20738](https://cve.now/CVE-2021-20738.md): WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information (no CVSS)
- [CVE-2021-20651](https://cve.now/CVE-2021-20651.md): Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an ex (no CVSS)
- [CVE-2021-20650](https://cve.now/CVE-2021-20650.md): Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administra (no CVSS)
- [CVE-2021-20649](https://cve.now/CVE-2021-20649.md): ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. (no CVSS)
- [CVE-2021-20648](https://cve.now/CVE-2021-20648.md): ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. (no CVSS)
- [CVE-2021-20647](https://cve.now/CVE-2021-20647.md): Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrato (no CVSS)
- [CVE-2021-20646](https://cve.now/CVE-2021-20646.md): Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrato (no CVSS)
- [CVE-2021-20645](https://cve.now/CVE-2021-20645.md): Cross-site scripting vulnerability in ELECOM WRC-300FEBK-A allows remote authenticated attackers to inject arbitrary script via unspecified (no CVSS)
- [CVE-2021-20644](https://cve.now/CVE-2021-20644.md): ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web se (no CVSS)
- [CVE-2021-20643](https://cve.now/CVE-2021-20643.md): Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected devic (no CVSS)
- [CVE-2020-5634](https://cve.now/CVE-2020-5634.md): ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware vers (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/elecom
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.