OS Command Injection Vulnerability in Elecom WebGUI Affects WRC-BE36QS-B and WRC-W701-B
CVE-2025-53472

8.6HIGH

Key Information:

Vendor

Elecom Co.,ltd.

Status
Wrc-be36qs-b
Wrc-w701-b
Vendor
CVE Published:
22 July 2025

What is CVE-2025-53472?

The vulnerability in Elecom's WebGUI for the WRC-BE36QS-B and WRC-W701-B router models allows a remote attacker to execute arbitrary OS commands. This flaw arises from improper neutralization of special elements within the OS command processing workflow, posing potential security risks to systems in use. Users are urged to update to the latest firmware to mitigate the risks associated with this vulnerability.

Affected Version(s)

WRC-BE36QS-B v1.1.3 and earlier

WRC-W701-B v1.1.3 and earlier

References

https://www.elecom.co.jp/news/security/20250722-01/
https://jvn.jp/en/vu/JVNVU91615135/

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53472 : OS Command Injection Vulnerability in Elecom WebGUI Affects WRC-BE36QS-B and WRC-W701-B