CVE-2026-42950

MediumCVSS 4.3

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

ELECOM wireless LAN access point devices do not check if the language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Risk Assessment

A malicious page could break the admin page view in a logged-in user's browser. This may hinder device management, though the description does not indicate direct data theft.

Recommendation

Update the device firmware to the version specified by the vendor. Until then, avoid visiting untrusted pages while logged into the admin panel.

Other vulnerabilities in ELECOM wireless LAN access point

CVE-2026-42948Medium
Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators inputs malicious data, an arbitrary script may be executed in another administrative user's web browser.

Original NVD description (English source)

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS