An OS Command Injection flaw exists in the WebUI of certain ELECOM wireless LAN routers and access points. The vulnerability permits an attacker who has authenticated access to the device to inject arbitrary operating‑system commands, effectively granting remote code execution with the privileges of the router. The flaw stems from inadequate validation of user input before passing it to system commands, as identified by CWE‑78. An attacker could use this to compromise the device, intercept traffic, or pivot to additional network targets.

Devices affected are the ELECOM WRC‑X3000GS3‑B and WRC‑X3000GS3A‑B series routers and access points. No specific firmware or MAC address ranges were disclosed, so any unit of these models currently deployed remains a potential target until confirmed patched.

The CVSS score of 8.6 classifies this flaw as high severity, and the EPSS score of 1% indicates a low‑to‑moderate likelihood of exploitation, though it is not yet listed in the CISA KEV catalog. Exploitation requires a valid login to the WebUI, so attackers must first breach credentials or obtain remote access to the administrative interface. Once authenticated, the attacker can execute any command, giving full control over the device. No publicly available exploits have been reported at this time, but the potential impact and high score warrant prompt action.