CVE-2026-42948

MediumCVSS 4.8

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators inputs malicious data, an arbitrary script may be executed in another administrative user's web browser.

Risk Assessment

An attacker with administrative privileges could execute malicious code in another administrator's browser, hijacking their session. This may lead to unauthorized device configuration changes.

Recommendation

Update the ELECOM device firmware to a patched version. Restrict administrative access to trusted networks and users.

Other vulnerabilities in ELECOM wireless LAN access point

CVE-2026-42950Medium
ELECOM wireless LAN access point devices do not check if the language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Original NVD description (English source)

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS