ELECOM wireless LAN access point devices vulnerabilities

ELECOM wireless LAN access point devices implement a CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked into performing unintended operations.

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper with the configuration file, and a victim administrator may be tricked into using a crafted configuration file.

The ELECOM wireless LAN access point devices have an OS command injection vulnerability that allows an authenticated user to execute arbitrary OS commands by sending a specially crafted request.