Restore Settings. If EUVD-2026-49726

Q: What is the CVSS score of EUVD-2026-49726?

EUVD-2026-49726 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

| CVE-2026-61376 HIGH

OS Command Injection (CWE-78)

2026-07-28 vultures@jpcert.or.jp

GHSA-xp32-8g58-6x75

Command Injection

8.6

CVSS 4.0 · Vendor: jpcert

Severity by source

Vendor (jpcert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (jpcert) · only source for this CVE.

CVSS VectorVendor: jpcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 09:32 vuln.today

CVE Published

Jul 28, 2026 - 09:16 cve.org

HIGH 8.6

DescriptionCVE.org

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

AnalysisAI

Authenticated OS command injection in ELECOM WAB series routers and access points allows authenticated attackers to execute arbitrary OS commands via the Restore Settings function. Full device compromise is possible, but no active exploitation or public exploit code is known at this time. The vulnerability is rated high severity (CVSS 8.6) but requires administrative credentials to exploit.