Read the docs
TI-2024-14949 Aliases CVE-2024-22372GHSA-mh49-xg6j-w6xh

OS command injection in ELECOM CO.,LTD. WRC-X1500GS-B

Priority LOW 34CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00829 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ELECOM CO.,LTD.WRC-X1500GS-Bup to v1.11—No fix listedCNA
ELECOM CO.,LTD.WRC-X1500GSA-Bup to v1.11—No fix listedCNA
ELECOM CO.,LTD.WRC-X1800GS-Bup to v1.17—No fix listedCNA
ELECOM CO.,LTD.WRC-X1800GSA-Bup to v1.17—No fix listedCNA
ELECOM CO.,LTD.WRC-X1800GSH-Bup to v1.17—No fix listedCNA
ELECOM CO.,LTD.WRC-X3000GS2-Bup to v1.08—No fix listedCNA
ELECOM CO.,LTD.WRC-X3000GS2-Wup to v1.08—No fix listedCNA
ELECOM CO.,LTD.WRC-X3000GS2A-Bup to v1.08—No fix listedCNA
ELECOM CO.,LTD.WRC-XE5400GS-Gup to v1.12—No fix listedCNA
ELECOM CO.,LTD.WRC-XE5400GSA-Gup to v1.12—No fix listedCNA
ELECOM CO.,LTD.WRC-X6000QS-Gup to v1.13—No fix listedCNA
ELECOM CO.,LTD.WRC-X6000QSA-Gup to v1.13—No fix listedCNA
ELECOM CO.,LTD.WRC-X6000XS-Gv1.09—No fix listedCNA
ELECOM CO.,LTD.WRC-X6000XST-Gup to v1.12—No fix listedCNA
ELECOM CO.,LTD.WRC-X3000GST2-Bup to v1.06—No fix listedCNA
  • WRC-X1500GS-B VendorELECOM CO.,LTD. Affected up to v1.11 Fixed in — No fix listed CNA
  • WRC-X1500GSA-B VendorELECOM CO.,LTD. Affected up to v1.11 Fixed in — No fix listed CNA
  • WRC-X1800GS-B VendorELECOM CO.,LTD. Affected up to v1.17 Fixed in — No fix listed CNA
  • WRC-X1800GSA-B VendorELECOM CO.,LTD. Affected up to v1.17 Fixed in — No fix listed CNA
  • WRC-X1800GSH-B VendorELECOM CO.,LTD. Affected up to v1.17 Fixed in — No fix listed CNA
  • WRC-X3000GS2-B VendorELECOM CO.,LTD. Affected up to v1.08 Fixed in — No fix listed CNA
  • WRC-X3000GS2-W VendorELECOM CO.,LTD. Affected up to v1.08 Fixed in — No fix listed CNA
  • WRC-X3000GS2A-B VendorELECOM CO.,LTD. Affected up to v1.08 Fixed in — No fix listed CNA
  • WRC-XE5400GS-G VendorELECOM CO.,LTD. Affected up to v1.12 Fixed in — No fix listed CNA
  • WRC-XE5400GSA-G VendorELECOM CO.,LTD. Affected up to v1.12 Fixed in — No fix listed CNA
  • WRC-X6000QS-G VendorELECOM CO.,LTD. Affected up to v1.13 Fixed in — No fix listed CNA
  • WRC-X6000QSA-G VendorELECOM CO.,LTD. Affected up to v1.13 Fixed in — No fix listed CNA
  • WRC-X6000XS-G VendorELECOM CO.,LTD. Affected v1.09 Fixed in — No fix listed CNA
  • WRC-X6000XST-G VendorELECOM CO.,LTD. Affected up to v1.12 Fixed in — No fix listed CNA
  • WRC-X3000GST2-B VendorELECOM CO.,LTD. Affected up to v1.06 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:elecom:wrc-x1800gs-b_firmware:*:*:*:*:*:*:*:*before 1.18VulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:wrc-x1800gs-b:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:wrc-x1800gsh-b_firmware:*:*:*:*:*:*:*:*before 1.18VulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:wrc-x1800gsh-b:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:wrc-x1800gsa-b_firmware:*:*:*:*:*:*:*:*before 1.18VulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:wrc-x1800gsa-b:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:wrc-x6000xs-g_firmware:1.09:*:*:*:*:*:*:*1.09VulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:wrc-x6000xs-g:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:wrc-x6000xst-g_firmware:*:*:*:*:*:*:*:*before 1.14VulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:wrc-x6000xst-g:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
  • cpe:2.3:o:elecom:wrc-x1800gs-b_firmware:*:*:*:*:*:*:*:* Versions before 1.18 Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:wrc-x1800gs-b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:wrc-x1800gsh-b_firmware:*:*:*:*:*:*:*:* Versions before 1.18 Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:wrc-x1800gsh-b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:wrc-x1800gsa-b_firmware:*:*:*:*:*:*:*:* Versions before 1.18 Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:wrc-x1800gsa-b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:wrc-x6000xs-g_firmware:1.09:*:*:*:*:*:*:* Versions 1.09 Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:wrc-x6000xs-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:wrc-x6000xst-g_firmware:*:*:*:*:*:*:*:* Versions before 1.14 Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:wrc-x6000xst-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22372
  2. 2026-10-03 Alias added: GHSA-mh49-xg6j-w6xh

References

Advisory 2

  • TI-2023-20586 Buffer overflow in ELECOM CO.,LTD. WRC-X1800GS-B CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences