The vulnerability is an OS command injection in the Elecom WRC‑X1500GS‑B and WRC‑X1500GSA‑B router models. A crafted request sent by a user that is already authenticated to the router can inject arbitrary shell commands, enabling the attacker to control the device’s operating system. Based on the description, it is inferred that this level of access could lead to a full compromise of confidentiality, integrity, and availability, consistent with the CWE‑78 classification.

The affected devices are the Elecom WRC‑X1500GS‑B and WRC‑X1500GSA‑B models. The flaw resides in their firmware and is not limited to specific firmware versions, so any router running the default or previously supplied firmware may be vulnerable. The vulnerability is documented for the hardware revisions as listed by Elecom.

The CVSS base score is 8.6, indicating a high severity flaw, yet the EPSS probability is below 1 %, suggesting rare exploitation in the wild. The flaw requires the attacker to have authenticated access to the router’s administrative interface, so the attack vector is likely internal or from an attacker who has compromised a legitimate user’s credentials. The router is not listed in the CISA KEV catalog, but its ability to execute arbitrary OS commands makes it a critical asset if exposed.