The vulnerability allows an attacker to calculate the initial passwords from device system information, effectively bypassing authentication. This yields full control over the device and enables further exploitation of its functions. The weakness corresponds to CWE-1391, describing the use of predictable or weak credentials.

Elecom Co., Ltd. WRC‑X1500GS‑B and WRC‑X1500GSA‑B routers are affected. The issue is present in the device firmware variants listed as wrc‑x1500gs‑b_firmware and wrc‑x1500gsa‑b_firmware; no specific patch versions are provided in the data.

The CVSS score is 5.1, indicating moderate impact, while the EPSS score of less than 1% shows a very low probability of exploitation and the vulnerability is not listed in CISA’s KEV catalogue. Attackers would likely need remote access to the device’s management interface or to read exposed system information to compute the default credentials. Because the vulnerability is limited to initial password derivation, it does not grant elevated privileges beyond those of a legitimate administrator and thus the overall risk is moderate.