CVE-2026-44387
MediumCVSS 5.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
ELECOM wireless LAN routers and access points are vulnerable to Reflected XSS in the WebUI. This could allow arbitrary script execution in a logged-in user's browser.
Risk Assessment
The risk includes potential session hijacking of an administrator or unauthorized actions in the device management interface.
Recommendation
Update the firmware of ELECOM devices to a version that patches this vulnerability.
Other vulnerabilities in ELECOM wireless LAN routers and access points
See all- CVE-2026-61376High
ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the Restore Settings function. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.
- CVE-2026-59764High
ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the WebUI. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.
Original NVD description (English source)
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser.