by Kastro
Paper/Archive/CVE-2026-40621

CVE-2026-40621

ELECOM CO.,LTD. WRC-BE72XSD-B — ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.2.422 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.

Affected

ProductAffectedFixed inSource
WRC-BE72XSD-Bv1.1.1 and earlier–CNA
WRC-BE72XSD-BAv1.1.1 and earlier–CNA
WRC-BE65QSD-Bv1.1.0 and earlier–CNA
WRC-W702-Bv1.1.0 and earlier–CNA

Scores by source

jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refelecom.co.jp/news/security/20260512-01refjvn.jp/en/jp/JVN03037325