A cross‑site request forgery flaw allows an attacker to cause a logged‑in user to send unintended requests to the router’s web interface, potentially changing configuration settings or performing other restricted actions. This attack undermines the integrity of the device’s configuration and can lead to service disruption or a stepping‑stone to further compromise.

The flaw affects ELECOM CO.,LTD routers including WRC‑X1500GS‑B, WRC‑X1500GSA‑B, WRC‑X1800GS‑B, WRC‑X1800GSA‑B, WRC‑X1800GSH‑B, WRC‑X3000GS2‑B, WRC‑X3000GS2‑W, WRC‑X3000GS2A‑B, WRC‑X3000GST2‑B, WRC‑X6000QS‑G, WRC‑X6000QSA‑G, WRC‑X6000XS‑G, WRC‑X6000XST‑G, WRC‑XE5400GS‑G, and WRC‑XE5400GSA‑G. Specific firmware version details are not provided; users should verify whether their device is running an affected release.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of active exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user to be logged into the router’s web interface and then visit a malicious webpage that triggers unauthorized requests. While no exploitation has been documented, the risk remains primarily from phishing or social‑engineering scenarios that coerce the user into visiting such a page.