A cross‑site request forgery flaw allows an attacker to trigger unapproved actions on the affected devices while a legitimate user is authenticated. The vulnerability can be leveraged to change device settings or perform other actions that compromise the integrity and reliability of the router, potentially enabling further attacks or service disruption.

This issue affects ELECOM CO.,LTD. WRC‑X1500GS‑B and WRC‑X1500GSA‑B routers. Users operating these specific models are susceptible.

The CVSS score of 5.1 indicates moderate severity. The EPSS rating of less than 1% reflects a low likelihood of active exploitation at the time of assessment, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to require a user who is logged into the router’s web interface to visit a malicious webpage that sends an unauthorized request. Because active exploitation has not been reported, the risk remains primarily related to phishing or social‑engineering scenarios where an authenticated user is tricked into visiting the attacker‑controlled page.