CVE-2026-59764: ELECOM Wireless LAN Router RCE Vulnerability

CVE-2026-59764 Overview

CVE-2026-59764 is an OS Command Injection vulnerability [CWE-78] affecting the WebUI of ELECOM wireless LAN routers and access points. An authenticated attacker who can log in to the product can execute arbitrary operating system commands on the underlying device. Successful exploitation gives an attacker control over router functionality, network traffic, and the embedded operating environment.

The vulnerability is reachable over the network and requires high privileges, but no user interaction. Confidentiality, integrity, and availability of the affected device are all at risk.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on affected ELECOM wireless LAN routers and access points, leading to full device compromise and potential pivoting into internal networks.

Affected Products

ELECOM wireless LAN routers (specific models listed in the vendor advisory)
ELECOM wireless LAN access points (specific models listed in the vendor advisory)
WebUI management interface component on affected devices

Discovery Timeline

2026-07-28 - CVE-2026-59764 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database
2026-07-28 - ELECOM published a coordinated advisory via JVN JVN56870912 Advisory and Elecom Security News Update

Technical Details for CVE-2026-59764

Vulnerability Analysis

The flaw is an OS Command Injection weakness in the WebUI of ELECOM wireless LAN routers and access points. The WebUI accepts user-supplied input through administrative functions and passes it to an underlying shell or system call without sufficient sanitization. This allows an authenticated attacker to append or inject shell metacharacters, causing the device to execute attacker-controlled commands.

Exploitation requires prior authentication to the device management interface. Once authenticated, an attacker can chain commands through vulnerable WebUI parameters to run code as the WebUI process, which typically runs with elevated privileges on embedded router firmware. The EPSS score of 1.129% (63.14 percentile) reflects moderate observed exploit activity signals for this class of embedded WebUI flaws.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. WebUI handlers construct shell commands using untrusted input from authenticated administrative sessions without escaping or validating shell metacharacters such as ;, |, &&, or backticks. When these constructed commands reach a system()-style call, injected payloads are executed by the device's shell.

Attack Vector

The attack vector is network-based against the router's WebUI, typically exposed on the LAN and, in some deployments, the WAN. An attacker first authenticates using valid administrative credentials, obtained through credential reuse, default credentials, phishing, or prior compromise. The attacker then submits a crafted request to a vulnerable WebUI endpoint, embedding shell metacharacters in a parameter that flows into an OS command. The device executes the injected command with the privileges of the WebUI service.

No verified public proof-of-concept code is available. Refer to the JVN JVN56870912 Advisory for authoritative technical details.

Detection Methods for CVE-2026-59764

Indicators of Compromise

Unexpected outbound connections originating from the router or access point management IP
WebUI access logs showing administrative logins from unfamiliar source IPs followed by requests containing shell metacharacters such as ;, |, `, or $(
New or modified processes on the device, or unexpected changes to firmware persistence areas (NVRAM, /etc, or startup scripts)
DNS or configuration changes on the router that were not made by administrators

Detection Strategies

Inspect WebUI HTTP request logs for parameters containing OS command separators or command substitution syntax
Monitor for anomalous administrative session activity, including logins outside normal hours or from atypical geographies
Correlate router configuration changes with authenticated session identifiers to detect abuse of administrative accounts

Monitoring Recommendations

Forward router and access point syslog data to a centralized logging platform for correlation with endpoint and network telemetry
Alert on new outbound connections from network infrastructure devices to previously unseen external hosts
Baseline administrative WebUI usage and alert on deviations such as bursts of configuration API calls

How to Mitigate CVE-2026-59764

Immediate Actions Required

Apply the firmware update published by ELECOM for each affected model as listed in the vendor advisory
Restrict WebUI access to trusted management VLANs and disable WAN-side administrative access
Rotate all administrative credentials on affected devices and remove any unused administrative accounts
Audit recent WebUI access logs for signs of exploitation prior to patching

Patch Information

ELECOM has published fixed firmware and mitigation guidance. Refer to the Elecom Security News Update for the list of affected models and corresponding firmware versions, and to the JVN JVN56870912 Advisory for the coordinated disclosure details.

Workarounds

Disable remote management on the WAN interface until the device firmware can be updated
Enforce strong, unique administrative passwords and, where supported, restrict WebUI access by source IP
Segment router management interfaces into a dedicated administrative network isolated from user and guest traffic
Replace end-of-life ELECOM devices that do not receive a firmware update addressing this vulnerability