// CVE · PUBLISHED 2026-05-13
CVE-2026-42062 ELECOM CO.,LTD. / WRC-BE72XSD-B · ELECOM CO.,LTD. / WRC-BE72XSD-BA · ELECOM CO.,LTD. / WRC-BE65QSD-B · +1
9.3 · CVSS 4.0 Critical
Description ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authentication is required.
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.
Details Products ELECOM CO.,LTD. / WRC-BE72XSD-B · ELECOM CO.,LTD. / WRC-BE72XSD-BA · ELECOM CO.,LTD. / WRC-BE65QSD-B · ELECOM CO.,LTD. / WRC-W702-B Published 13 May 2026 Modified 26 Oct 2026 CVSS 9.3 Critical (v4.0) Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Score source vultures@jpcert.or.jp CWE CWE-78 Record status Deferred