CVE-2026-42961
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
ELECOM wireless LAN access point devices implement a CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked into performing unintended operations.
Risk Assessment
An attacker can abuse an administrator's session to change device configuration without their knowledge. This may lead to takeover of the wireless network.
Recommendation
Update ELECOM access point firmware to a version containing the fix. Additionally, advise administrators to log out after finishing work in the management panel.
Other vulnerabilities in ELECOM wireless LAN access point devices
See all- CVE-2026-25107Medium
ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper with the configuration file, and a victim administrator may be tricked into using a crafted configuration file.
- CVE-2023-40072High
The ELECOM wireless LAN access point devices have an OS command injection vulnerability that allows an authenticated user to execute arbitrary OS commands by sending a specially crafted request.
Original NVD description (English source)
ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS