CVE-2026-25107: ELECOM Wireless LAN devices hard-coded key in configuration backups

CVE-2026-25107 · Severity: medium · CVSS 6.5 · Published 2026-05-13

ELECOM wireless routers and access points use a fixed, non-secret encryption key when creating backup files of their settings. An attacker who knows this key can create a modified configuration file and trick a network administrator into uploading it to the device. If successful, this allows the attacker to change device settings, potentially compromising the security of the entire local network.

Technologies: Elecom Wrc-X3000gs2-B, Elecom Wrc-X3000gs2-W, Elecom Wrc-X3000gs2a-B. Vendors: Elecom.

Quick answers

Is CVE-2026-25107 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25107 being exploited in the wild.
How severe is CVE-2026-25107?
Medium severity, with a CVSS score of 6.5, published 13 May 2026.
Which products and versions are affected?
Elecom WRC-X1800GS-B v1.19 and earlier; Elecom WRC-X1800GSA-B v1.19 and earlier; Elecom WRC-X1800GSH-B v1.19 and earlier; Elecom Wrc-X3000gs2-B v1.09 and earlier; and 8 more.
Is there a fix for CVE-2026-25107?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-25107 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-25107?
Check whether you run Elecom WRC-X1800GS-B, Elecom WRC-X1800GSA-B, Elecom WRC-X1800GSH-B or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Use of Hard-coded Cryptographic Key (CWE-321) vulnerability exists in multiple ELECOM wireless LAN routers and access points. The affected devices utilize a static, hard-coded key to encrypt configuration backup files. An attacker with knowledge of this key can decrypt legitimate backups or generate malicious ones. The attack requires user interaction, as a victim administrator must be tricked into uploading and applying the crafted configuration file to the device. Successful exploitation allows the attacker to modify device parameters, which could lead to further compromise of the network infrastructure. Firmware updates have been released to address this issue.

Affected products

  • ELECOM WRC-X3000GS2-B v1.09 and earlier
  • ELECOM WRC-X3000GS2-W v1.09 and earlier
  • ELECOM WRC-X3000GS2A-B v1.09 and earlier
  • ELECOM WRC-X3000GST2-B v1.06 and earlier
  • ELECOM WRC-X1800GS-B v1.19 and earlier
  • ELECOM WRC-X1800GSA-B v1.19 and earlier
  • ELECOM WRC-X1800GSH-B v1.19 and earlier
  • ELECOM WRC-X6000QS-G v1.14 and earlier
  • ELECOM WRC-X6000QSA-G v1.14 and earlier
  • ELECOM, WRC-X6000XS-G v1.12 and earlier
  • ELECOM WRC-X6000XST-G v1.16 and earlier
  • ELECOM WRC-XE5400GS-G v1.13 and earlier
  • ELECOM WRC-XE5400GSA-G v1.13 and earlier

Timeline

  • 2026-05-12: advisory: Initial advisory published by JVN and ELECOM
  • 2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.