CVE-2026-24449
CVE-2026-24449 is a medium-severity vulnerability in Elecom Wrc-x1500gsa-b Firmware with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1391.
Key facts
- Severity: Medium (CVSS 3.x base score 4.6)
- CVSS v4: 5.1
- EPSS exploit prediction: 0% (9th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-5271
- Weakness: CWE-1391
- Affected product: Elecom Wrc-x1500gsa-b Firmware
- Published:
- Last modified:
Description
For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.
Frequently asked questions
- What is CVE-2026-24449?
- For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.
- How severe is CVE-2026-24449?
- CVE-2026-24449 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-24449 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-24449?
- CVE-2026-24449 primarily affects Elecom Wrc-x1500gsa-b Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-24449?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-24449 have an EU (EUVD) identifier?
- Yes. CVE-2026-24449 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5271.
- When was CVE-2026-24449 published?
- CVE-2026-24449 was published on 2026-02-03 and last updated on 2026-06-17.
References
Affected products (2)
- cpe:2.3:o:elecom:wrc-x1500gsa-b_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:elecom:wrc-x1500gs-b_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Elecom Wrc-x1500gsa-b Firmware
- CVE-2026-24465 — Critical (CVSS 9.8): Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices. A crafted packet may lead…
- CVE-2026-22550 — High (CVSS 8.8): OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may…
- CVE-2024-40883 — High (CVSS 8.8): Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging…
All CVEs affecting Elecom Wrc-x1500gsa-b Firmware →
Other CWE-1391 vulnerabilities
- CVE-2025-67114 — Critical (CVSS 9.8): Use of a deterministic credential generation algorithm in /ftl/bin/calc_f2 in Small Cell Sercomm SCE4255W (FreedomFi…
- CVE-2026-22886 — Critical (CVSS 9.8): OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the…
- CVE-2025-30519 — Critical (CVSS 9.8): Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through…
- CVE-2025-6077 — Critical (CVSS 9.8): Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and…
- CVE-2024-51978 — Critical (CVSS 9.8): An unauthenticated attacker who knows the target device's serial number, can generate the default administrator…
- CVE-2024-12728 — Critical (CVSS 9.8): A weak credentials vulnerability potentially allows privileged system access via SSH to Sophos Firewall older than…