CVE-2026-25107: Elecom Co.,ltd Wrc-x1800gs-B

Medium severity, CVSS 6.9. EPSS: 0.1% chance of exploitation in the next 30 days.

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.

Affected products

• Elecom Co.,ltd Wrc-x1800gs-B: up to and including v1.19
• Elecom Co.,ltd Wrc-x1800gsa-B: up to and including v1.19
• Elecom Co.,ltd Wrc-x1800gsh-B: up to and including v1.19
• Elecom Co.,ltd Wrc-x3000gs2-B: up to and including v1.09
• Elecom Co.,ltd Wrc-x3000gs2-W: up to and including v1.09
• Elecom Co.,ltd Wrc-x3000gs2a-B: up to and including v1.09
• Elecom Co.,ltd Wrc-x3000gst2-B: up to and including v1.06
• Elecom Co.,ltd Wrc-x6000qs-G: up to and including v1.14
• Elecom Co.,ltd Wrc-x6000qsa-G: up to and including v1.14
• Elecom Co.,ltd Wrc-x6000xs-G: up to and including v1.12
• Elecom Co.,ltd Wrc-x6000xst-G: up to and including v1.16
• Elecom Co.,ltd Wrc-XE5400GS-G: up to and including 1.13
• Elecom Co.,ltd Wrc-XE5400GSA-G: up to and including v1.13

Published 2026-05-13. Last modified 2026-06-17.