# CVE-2026-22550: ELECOM Wireless LAN products OS command injection

Source: https://junglewise.ai/threats/cve-2026-22550-elecom-wireless-lan-products-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2026-22550 · Severity: high · CVSS 8.8 · Published 2026-02-03

A security vulnerability has been identified in several ELECOM wireless LAN routers. These devices are used to provide Wi-Fi and network connectivity in homes and small offices. If an attacker gains access to a user account on the device, they can take complete control of the router, potentially leading to data interception or network disruption.

Vendors: [Elecom](https://junglewise.ai/threats/vendors/elecom).

## Quick answers

**Is CVE-2026-22550 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22550 being exploited in the wild.

**How severe is CVE-2026-22550?** High severity, with a CVSS score of 8.8, published 3 February 2026.

**Which products and versions are affected?** Elecom WRC-X1800GS-B firmware v1.19 and earlier; Elecom WRC-X1800GSA-B firmware v1.19 and earlier; Elecom WRC-X1800GSH-B firmware v1.19 and earlier; Elecom Wrc-X3000gs2-B Firmware v1.09 and earlier; and 9 more.

**Is there a fix for CVE-2026-22550?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22550 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-22550?** Check whether you run Elecom Wrc-X1500gs-B, Elecom Wrc-X1500gs-B Firmware, Elecom Wrc-X1500gsa-B or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the management interface of various ELECOM wireless LAN routers. The flaw is triggered when the application fails to properly neutralize special elements in a crafted request sent by an authenticated user. An attacker with valid login credentials can exploit this to execute arbitrary OS commands with the privileges of the web server. This could lead to full system compromise, unauthorized configuration changes, or persistent access to the local network. Firmware updates have been released for supported models to address this issue.

## Affected products

- ELECOM WRC-X1500GS-B firmware v1.12 and earlier
- ELECOM WRC-X1500GSA-B firmware v1.12 and earlier
- ELECOM WRC-X3000GS2-B firmware v1.09 and earlier
- ELECOM WRC-X3000GS2-W firmware v1.09 and earlier
- ELECOM WRC-X3000GS2A-B firmware v1.09 and earlier
- ELECOM WRC-X3000GST2-B firmware v1.06 and earlier
- ELECOM WRC-X1800GS-B firmware v1.19 and earlier
- ELECOM WRC-X1800GSA-B firmware v1.19 and earlier
- ELECOM WRC-X1800GSH-B firmware v1.19 and earlier
- ELECOM WRC-X6000QS-G firmware v1.14 and earlier
- ELECOM, WRC-X6000QSA-G firmware v1.14 and earlier
- ELECOM WRC-X6000XS-G firmware v1.12 and earlier
- ELECOM WRC-X6000XST-G firmware v1.16 and earlier
- ELECOM WRC-XE5400GS-G firmware v1.13 and earlier
- ELECOM WRC-XE5400GSA-G firmware v1.13 and earlier

## Timeline

- 2026-02-03: disclosed
- 2026-02-03: advisory
- 2026-05-12: other: Advisory updated with additional affected products.

## References

- [https://jvn.jp/en/jp/JVN94012927/](https://jvn.jp/en/jp/JVN94012927/)
- [https://www.elecom.co.jp/news/security/20260203-01/](https://www.elecom.co.jp/news/security/20260203-01/)

## Related threats

- [ELECOM Wireless LAN products CSRF vulnerability](https://junglewise.ai/threats/cve-2026-20704-elecom-wireless-lan-products-csrf-vulnerability)
- [Elecom WRC-X3000 Series XSS in easysetup.cgi](https://junglewise.ai/threats/cve-2024-34577-elecom-wrc-x3000-series-xss-in-easysetup-cgi)