Elecom devices such as the WAB-I1750-PS, WAB-M1775-PS, WAB-M2133, WAB-S1167-PS, and WAB-S1775 routers contain an OS command injection flaw in the Restore Settings function. An attacker who can authenticate to the device can inject arbitrary operating system commands, allowing execution with the privileges of the web server process. This vulnerability can lead to complete compromise of the affected device, enabling the attacker to modify configuration, exfiltrate data, or pivot to other network assets.

The affected models are ELECOM wireless LAN routers and access points under the brand names WAB-I1750-PS, WAB-M1775-PS, WAB-M2133, WAB-S1167-PS, and WAB-S1775. No specific firmware ranges were listed, so all firmware versions of these models are potentially vulnerable unless a patch has been released.

The CVSS score of 8.6 points to high severity. The EPSS score of 1% indicates that the likelihood of exploitation is low to moderate, but the presence of an authenticated command injection makes it a serious threat. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to have login credentials; therefore, the exploitation vector is an authenticated network attack, most likely via the device’s management web interface.