CVE-2023-40072
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
The ELECOM wireless LAN access point devices have an OS command injection vulnerability that allows an authenticated user to execute arbitrary OS commands by sending a specially crafted request.
Risk Assessment
This vulnerability could lead to unauthorized access to the device's operating system, posing a significant security risk to the network.
Recommendation
It is recommended to update the firmware of ELECOM devices to the latest version to mitigate this vulnerability and to monitor logs for potential exploitation attempts.
Other vulnerabilities in ELECOM wireless LAN access point devices
See all- CVE-2026-42961Medium
ELECOM wireless LAN access point devices implement a CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked into performing unintended operations.
- CVE-2026-25107Medium
ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper with the configuration file, and a victim administrator may be tricked into using a crafted configuration file.
Original NVD description (English source)
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS