CSRF Vulnerability in ELECOM Wireless LAN Access Point
CVE-2026-42961

5.1MEDIUM

Key Information:

Vendor

Elecom Co.,ltd.

Status
Wab-be187-m
Wab-be72-m
Wab-be36-m
Wab-be36-s
Vendor
CVE Published:
13 May 2026

What is CVE-2026-42961?

ELECOM wireless LAN access point devices have a Cross-Site Request Forgery (CSRF) vulnerability due to insufficient handling of CSRF tokens. This weakness allows attackers to potentially exploit logged-in users who inadvertently visit a malicious webpage, triggering unauthorized actions on the device. Users should remain vigilant and apply necessary security updates to mitigate this risk.

Affected Version(s)

WAB-BE187-M v1.1.10 and earlier

WAB-BE36-M v1.1.3 and earlier

WAB-BE36-S v1.1.3 and earlier

References

https://www.elecom.co.jp/news/security/20260512-01/
https://jvn.jp/en/jp/JVN03037325/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.