CVE-2026-25107
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper with the configuration file, and a victim administrator may be tricked into using a crafted configuration file.
Risk Assessment
Knowledge of the key allows crafting a malicious configuration that, once imported, can alter device security settings. This may lead to unauthorized network access.
Recommendation
Update ELECOM firmware to a version that removes the hard-coded key. Verify the origin of configuration files before importing them.
Other vulnerabilities in ELECOM wireless LAN access point devices
See all- CVE-2026-42961Medium
ELECOM wireless LAN access point devices implement a CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked into performing unintended operations.
- CVE-2023-40072High
The ELECOM wireless LAN access point devices have an OS command injection vulnerability that allows an authenticated user to execute arbitrary OS commands by sending a specially crafted request.
Original NVD description (English source)
ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS