CVE-2026-20704: ELECOM Wireless LAN products CSRF vulnerability

CVE-2026-20704 · Severity: medium · CVSS 4.3 · Published 2026-02-03

A security vulnerability exists in several ELECOM wireless routers that could allow an attacker to perform unauthorized actions on the device. If a logged-in administrator visits a malicious website, the attacker can trick the router into changing its settings without the user's knowledge. This could lead to unauthorized configuration changes that compromise the security of the local network.

Technologies: Elecom Wrc-X3000gs2-B, Elecom Wrc-X3000gs2-W, Elecom Wrc-X3000gs2a-B. Vendors: Elecom.

Quick answers

Is CVE-2026-20704 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20704 being exploited in the wild.
How severe is CVE-2026-20704?
Medium severity, with a CVSS score of 4.3, published 3 February 2026.
Which products and versions are affected?
Elecom Wrc-X1500gs-B v1.12 and earlier versions; Elecom Wrc-X1500gsa-B v1.12 and earlier versions; Elecom WRC-X1800GS-B v1.19 and earlier versions; Elecom WRC-X1800GSA-B v1.19 and earlier versions; and 10 more.
Is there a fix for CVE-2026-20704?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20704 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20704?
Check whether you run Elecom Wrc-X1500gs-B, Elecom Wrc-X1500gsa-B, Elecom WRC-X1800GS-B or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) exists in the web management interface of various ELECOM wireless LAN products. The vulnerability stems from insufficient validation of requests to ensure they originated from the intended user. An attacker can exploit this by tricking an authenticated administrator into visiting a malicious webpage, which then sends unauthorized requests to the router's management interface. Successful exploitation allows the attacker to perform unintended operations or modify device configurations. Firmware updates have been released for supported models to mitigate this issue.

Affected products

  • ELECOM WRC-X1500GS-B v1.12 and earlier versions
  • ELECOM WRC-X1500GSA-B v1.12 and earlier versions
  • ELECOM WRC-X3000GS2-B v1.09 and earlier versions
  • ELECOM WRC-X3000GS2-W v1.09 and earlier versions
  • ELECOM WRC-X3000GS2A-B v1.09 and earlier versions
  • ELECOM WRC-X3000GST2-B v1.06 and earlier versions
  • ELECOM WRC-X1800GS-B v1.19 and earlier versions
  • ELECOM WRC-X1800GSA-B v1.19 and earlier versions
  • ELECOM WRC-X1800GSH-B v1.19 and earlier versions
  • ELECOM WRC-X6000QS-G v1.14 and earlier version
  • ELECOM, WRC-X6000QSA-G v1.14 and earlier versions
  • ELECOM WRC-X6000XS-G v1.12 and earlier versions
  • ELECOM WRC-X6000XST-G v1.16 and earlier versions
  • ELECOM WRC-XE5400GS-G v1.13 and earlier versions
  • ELECOM WRC-XE5400GSA-G v1.13 and earlier versions

Timeline

  • 2026-02-03: disclosed
  • 2026-02-03: advisory
  • 2026-05-12: other: Advisory updated with additional affected products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.