CVE-2025-36519: ELECOM Router RCE Vulnerability

CVE-2025-36519 is a remote code execution flaw in ELECOM routers including WRC-2533GST2 and WRC-1167GST2 models that allows authenticated attackers to upload malicious files and execute arbitrary code. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-36519 Overview

CVE-2025-36519 is an unrestricted file upload vulnerability affecting multiple Elecom WRC series wireless routers. The flaw allows a remote authenticated attacker to upload a specially crafted file containing dangerous content. Successful exploitation can result in arbitrary code execution on the affected device. The issue is tracked as CWE-434 (Unrestricted Upload of File with Dangerous Type) and requires valid authentication over the network.

Critical Impact
An authenticated remote attacker can upload a malicious file and execute arbitrary code on the router, potentially compromising the device and traffic passing through it.

Affected Products

Elecom WRC-2533GST2, WRC-1167GST2 (all listed variants)
Elecom WRC-2533GS2V-B, WRC-2533GS2-B firmware v1.69 and earlier
Elecom WRC-2533GS2-W, WRC-1167GS2-B, WRC-1167GS2H-B

Discovery Timeline

2025-06-24 - CVE-2025-36519 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36519

Vulnerability Analysis

The vulnerability resides in the file upload handling logic of the affected Elecom WRC router firmware. The web management interface accepts file uploads from authenticated users without adequately validating the file type, extension, or content. An attacker who has already authenticated to the router administration interface can submit a crafted file that the router later processes or executes.

The vulnerability class (CWE-434) typically arises when server-side code trusts client-supplied metadata such as filename or MIME type. Attackers can bypass superficial checks by manipulating extensions, embedding executable content, or targeting file locations that the underlying operating system interprets as scripts or binaries.

Because the affected products are consumer and small-office wireless routers, a compromised device gives attackers a persistent foothold on the network perimeter. From that position, attackers can intercept traffic, pivot to internal hosts, or add the device to a botnet.

Root Cause

The root cause is insufficient validation of uploaded files in the router's management interface. The firmware fails to enforce allow-listed file types, verify magic bytes, or restrict upload destinations to non-executable directories. As a result, files that should be rejected are stored and can be triggered as executable content.

Attack Vector

Exploitation requires network access to the router's administration interface and valid credentials. The attacker authenticates, submits a crafted upload request to the vulnerable endpoint, and then triggers execution of the uploaded content. No user interaction beyond the attacker's own session is required. Refer to the JVN #39435597 advisory and the Elecom Security News Release for vendor-supplied technical details.

Detection Methods for CVE-2025-36519

Indicators of Compromise

Unexpected files present in router web directories or firmware writable partitions after an administrative login.
Administrator logins from unfamiliar source IP addresses, especially outside normal management windows.
Router processes spawning shells, cron entries, or outbound connections to unknown hosts.

Detection Strategies

Monitor router administration logs for successful authentication events followed by POST requests to file upload endpoints.
Inspect HTTP request bodies traversing the network for uploads targeting router management IPs with executable extensions or shell payloads.
Compare firmware file system state against a known-good baseline to detect unauthorized additions.

Monitoring Recommendations

Alert on any WAN-side access to router administration ports; management interfaces should not be exposed externally.
Track credential reuse and failed-then-successful login patterns against router accounts.
Log DNS and outbound connections originating from the router itself to identify command-and-control activity.

How to Mitigate CVE-2025-36519

Immediate Actions Required

Apply the firmware update published by Elecom for each affected model as referenced in the Elecom Security News Release.
Change the router administrator password to a strong, unique value and rotate any credentials that may have been exposed.
Disable remote (WAN) management on the router and restrict administrative access to trusted LAN segments.

Patch Information

Elecom has published firmware updates and mitigation guidance in its security advisory. Consult the Elecom Security News Release and JVN #39435597 for the fixed firmware versions applicable to each WRC model. Devices running v1.69 or earlier of the identified models are in scope.

Workarounds

Place affected routers behind a network segment that limits management access to a dedicated administrative host or VLAN.
If a patched firmware version is unavailable for a specific model, retire the device or replace it with a supported product.
Enforce multi-factor authentication upstream where possible and audit router accounts to remove unused administrative users.