# CVE-2026-42062: ELECOM Wireless LAN Devices OS command injection in username parameter

Source: https://junglewise.ai/threats/cve-2026-42062-elecom-wireless-lan-devices-os-command-injection-in-username  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-42062 · Severity: critical · CVSS 9.8 · Published 2026-05-13

ELECOM wireless routers and access points contain a critical security flaw that allows an attacker to take full control of the device. By sending a specially crafted request to the device's management interface, an unauthorized person can execute system-level commands without needing a password. This could lead to the interception of network traffic, unauthorized access to the local network, or a complete shutdown of internet services.

Technologies: [Elecom WRC-BE65QSD-B](https://junglewise.ai/threats/technologies/wrc-be65qsd-b), [Elecom WRC-BE72XSD-B](https://junglewise.ai/threats/technologies/wrc-be72xsd-b), [Elecom WRC-BE72XSD-BA](https://junglewise.ai/threats/technologies/wrc-be72xsd-ba), [Elecom WRC-W702-B](https://junglewise.ai/threats/technologies/wrc-w702-b). Vendors: [Elecom](https://junglewise.ai/threats/vendors/elecom).

## Quick answers

**Is CVE-2026-42062 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42062 being exploited in the wild.

**How severe is CVE-2026-42062?** Critical severity, with a CVSS score of 9.8, published 13 May 2026.

**Which products and versions are affected?** Elecom WRC-BE65QSD-B v1.1.0 and earlier; Elecom WRC-BE72XSD-B v1.1.1 and earlier; Elecom WRC-BE72XSD-BA v1.1.1 and earlier; Elecom WRC-W702-B v1.1.0 and earlier.

**Is there a fix for CVE-2026-42062?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42062 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42062?** Check whether you run Elecom WRC-BE65QSD-B, Elecom WRC-BE72XSD-B, Elecom WRC-BE72XSD-BA or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in several ELECOM wireless LAN routers and access points due to improper neutralization of special elements within the 'username' parameter. The flaw is reachable over the network and does not require any authentication or user interaction. An attacker can exploit this by sending a crafted HTTP request to the device, leading to arbitrary command execution with the privileges of the web service (typically root on embedded devices). Affected models include WRC-BE72XSD-B, WRC-BE72XSD-BA, WRC-BE65QSD-B, and WRC-W702-B. Users are advised to update to the latest firmware versions provided by the vendor.

## Affected products

- ELECOM WRC-BE72XSD-B v1.1.1 and earlier
- ELECOM WRC-BE72XSD-BA v1.1.1 and earlier
- ELECOM WRC-BE65QSD-B v1.1.0 and earlier
- ELECOM WRC-W702-B v1.1.0 and earlier

## Timeline

- 2026-05-12: advisory: Initial advisory published by JVN and ELECOM
- 2026-05-13: disclosed: CVE published to NVD

## References

- [https://jvn.jp/en/jp/JVN03037325/](https://jvn.jp/en/jp/JVN03037325/)
- [https://www.elecom.co.jp/news/security/20260512-01/](https://www.elecom.co.jp/news/security/20260512-01/)

## Related threats

- [ELECOM Wireless LAN devices authentication bypass in web interface](https://junglewise.ai/threats/cve-2026-40621-elecom-wireless-lan-devices-authentication-bypass-in-web)
- [ELECOM Wireless LAN Access Points OS command injection in ping_ip_addr](https://junglewise.ai/threats/cve-2026-35506-elecom-wireless-lan-access-points-os-command-injection-in-ping-ip)