ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration

1. Basic Information

• Article Title: Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026)
• Source: JVN
• Publication Date: July 28, 2026
• Original URL: https://jvn.jp/jp/JVN56870912/index.html
• Related Source: ELECOM Notice (Linked from JVN)
• Related Entities:
  • CVE-2026-44387 (Reflected XSS)
  • CVE-2026-59764 (Management Screen OS Command Injection)
  • CVE-2026-61376 (Configuration Restoration OS Command Injection)
  • WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B
• Severity: Medium

2. Executive Summary

An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network.

3. Attack Flow

Chain A: Attacker Already Has Administrator Credentials

1. The attacker reaches the management screen.
2. The attacker logs in as an administrator.
3. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376.
4. Arbitrary commands execute on the device OS.
5. Inference: Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion.

Chain B: Reflected XSS

1. An attacker on the same or an adjacent network prepares a crafted URL.
2. The attacker tricks a user who can access the management screen into opening the URL.
3. A script executes in the management screen origin via CVE-2026-44387.
4. Inference: If a management session exists, it may chain into unintended management actions.

4. Attacker Position and Execution Location

• XSS requires adjacent network reachability and user interaction.
• OS command injection is executed by an administrator with network reachability.
• Commands run on the router/AP embedded OS.

5. Visibility for Victims and Administrators

• The management screen may look normal.
• Signs include configuration changes, DNS anomalies, reboots, unstable network connections, and traffic to unknown destinations.
• Standard endpoint EDR tools cannot monitor the inside of network devices.
• For XSS, the script executes in the browser only when an administrator opens the crafted URL.

6. Conditions for Success and Failure

Success Conditions

• The target device runs a vulnerable firmware version.
• The attacker reaches the management screen.
• For command injection, successful administrator login.
• For XSS, adjacent network access and user interaction.

Failure Conditions

• Latest firmware applied.
• Management screen restricted to a dedicated VLAN or source ACL.
• Default or weak passwords removed.
• Suspicious URL access blocked from management devices.
• Configuration backups, changes, and restorations strictly managed.

7. What Happens Upon Success

Arbitrary commands execute on the device, potentially modifying management settings and communication paths. As an Inference, potential impacts include DNS tampering, traffic forwarding, credential theft, internal network pivoting, and denial of service, though JVN has not reported actual subsequent payloads or active exploitation.

8. Observable Logs

Email

• None.

Proxy / SWG / DNS

• Crafted URLs accessed from management devices.
• Changes in DNS responses and upstream DNS servers after device configuration changes.
• Traffic from routers/APs to unknown destinations.

Endpoint / EDR

• Suspicious scripts with the management screen origin on management device browsers.
• Commands inside network devices are out of EDR scope.

Identity / IdP

• Local administrator logins.
• Abnormal login times or new traffic sources for the same ID.

SaaS / Cloud

• Configuration change audits if cloud management integration is used. Public details are not available.

Network

• New traffic sources to management HTTP(S).
• Configuration restoration/upload, reboots, and DNS/NAT/forwarding changes.
• Abnormal egress traffic from the device.

9. Attack Success Determination

• Contact Only: Management screen discovery, XSS URL received.
• User Interaction: Viewing the XSS crafted URL.
• Initial Execution: Script execution on the management origin, configuration restoration processing.
• Malware or Auth Success: Administrator login, command execution results.
• Info Theft / Session Compromise: Management session/configuration acquisition, DNS/forwarding tampering.
• Post-Exploitation Confirmation: Persistent settings, internal scanning, unknown C2, credential abuse.

10. Investigation Playbook

Trigger

Vulnerable device detection, unknown management login, configuration restoration, DNS/NAT changes, abnormal device egress.

Initial Check

1. Confirm model, firmware, serial number, and installation location.
2. Check the reachability of the management screen and management accounts.
3. Compare current settings with known good backups.

Endpoints

• Check browser history, proxies, EDR, and downloaded configuration files on management devices.

Authentication & Cloud

• Rotate management passwords.
• Check cloud management integration tokens and change logs.

Subsequent Actions

• Investigate DNS, DHCP, NAT, VPN, forwarding, administrators, firmware, and time settings.
• Search for internal exploration or authentication anomalies via the device.

Containment

• Isolate the management interface and update to the latest firmware.
• If compromise is suspected, reset the device, and manually rebuild using verified configurations.
• Change related credentials.

Judgment Categories

Vulnerable / Access Attempt / Admin Login / Command Execution Suspected / Configuration Compromise / Network Pivot.

11. Defense and Detection Ideas

Single Events

• Management login from an unknown source.
• Configuration restoration events.
• DNS/NAT/administrator changes.
• Unknown egress from routers/APs.

Timeline Correlation

New Management Source → Login → Config Restoration/Input → Config Change/Reboot → DNS/Egress Anomaly

Threat Hunting Perspective

• Match target model numbers and firmware against the asset inventory.
• Identify devices where the management screen is reachable from user VLANs or the Internet.
• Identify common or default management passwords.

Log Gaps

Determining success is difficult without device management logs, configuration diffs, DNS/DHCP/NAT changes, and NetFlow.

Priority Countermeasures

1. Update firmware.
2. Isolate management interfaces and use ACLs.
3. Use unique, strong management passwords.
4. Manage configuration backup integrity.
5. Centralize network device logs.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-59764 and CVE-2026-61376 are OS command injections requiring administrator privileges.
• CVE-2026-44387 is a reflected XSS requiring an adjacent network and user interaction.
• JVN lists vulnerable models/versions and recommends updating to the latest firmware.
• Public materials contain no record of active exploitation or IOCs.

Inference

• If administrator credentials are already compromised, command injection can lead directly to full device compromise.
• If XSS executes on a management session, it may create opportunities to chain into management actions.

Hypothesis

• Correlating configuration restoration and DNS/NAT changes immediately following a management login serves as a high-confidence indicator of compromise.
• Devices with poorly isolated management interfaces may still exist in various branch offices and remote locations.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application — Only if the management interface is exposed externally (Medium Confidence).
• T1059 Command and Scripting Interpreter — Upon successful command injection (High Confidence).
• T1078 Valid Accounts — Using management credentials (High Confidence).
• T1601.001 Modify System Image — Only during firmware modification (Low Confidence).
• T1565.002 Transmitted Data Manipulation — Only during DNS/forwarding tampering (Hypothesis).
• T1090 Proxy — Only if traffic relay is confirmed (Low Confidence).

14. Unknowns and Additional Investigation

• Specific vulnerable parameters and configuration file formats.
• Command execution privileges and persistence scope.
• Active exploitation, PoCs, and IOCs.
• Total number of target models deployed globally.

15. Impact on SOCs

Because these devices are deployed across offices, retail stores, and remote locations, the relevance to general enterprise security is high. If a Security Operations Center (SOC) monitors only PCs and servers, these threats will be missed. Therefore, SOCs must include hardware model numbers, firmware versions, management reachability, configuration diffs, and network device logs in their operational monitoring scope.

16. Summary by Target Audience

For SOCs

Correlate management logins, configuration restorations, DNS/NAT changes, and device egress to address gaps in device logging.

For Administrators

Update target devices, restrict management interfaces to dedicated VLANs/ACLs, use unique passwords, and maintain verified configuration backups.

For Users

Do not open suspicious links while logged in to the management screen, and promptly report any anomalies in network destinations or DNS.