Is CVE-2026-42950 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42950 being exploited in the wild.

How severe is CVE-2026-42950?

Medium severity, with a CVSS score of 4.3, published 13 May 2026.

Which products and versions are affected?

Elecom WAB-BE187-M v1.1.10 and earlier; Elecom WAB-BE36-M v1.1.3 and earlier; Elecom WAB-BE36-S v1.1.3 and earlier; Elecom WAB-BE72-M v1.1.3 and earlier.

Is there a fix for CVE-2026-42950?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42950 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-42950?

Check whether you run Elecom WAB-BE187-M, Elecom WAB-BE36-M, Elecom WAB-BE36-S or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42950: ELECOM Wireless LAN Access Point improper validation of language parameter

CVE-2026-42950 · Severity: medium · CVSS 4.3 · Published 2026-05-13

ELECOM wireless LAN access points are affected by a vulnerability that fails to properly validate language settings. If an administrator visits a malicious website while logged into the device's management interface, the attacker can cause the administration page to malfunction or become unusable. This can disrupt the ability of staff to manage the network hardware.

Technologies: Elecom WAB-BE187-M, Elecom WAB-BE36-M, Elecom WAB-BE36-S, Elecom WAB-BE72-M. Vendors: Elecom.

Quick answers

Is CVE-2026-42950 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42950 being exploited in the wild.
How severe is CVE-2026-42950?: Medium severity, with a CVSS score of 4.3, published 13 May 2026.
Which products and versions are affected?: Elecom WAB-BE187-M v1.1.10 and earlier; Elecom WAB-BE36-M v1.1.3 and earlier; Elecom WAB-BE36-S v1.1.3 and earlier; Elecom WAB-BE72-M v1.1.3 and earlier.
Is there a fix for CVE-2026-42950?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42950 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-42950?: Check whether you run Elecom WAB-BE187-M, Elecom WAB-BE36-M, Elecom WAB-BE36-S or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as Improper Check for Unusual or Exceptional Conditions (CWE-754) exists in the web management interface of several ELECOM wireless access points. The application fails to validate the 'language' parameter, allowing it to be set to unexpected or inappropriate values. An attacker can exploit this via a Cross-Site Request Forgery (CSRF) style attack by tricking a logged-in administrator into visiting a malicious URL. Successful exploitation results in a partial denial of service where the administrative web interface becomes 'broken' or inaccessible to the user. Firmware updates are available to resolve this issue.

Affected products

ELECOM WAB-BE187-M v1.1.10 and earlier
ELECOM WAB-BE72-M v1.1.3 and earlier
ELECOM WAB-BE36-M v1.1.3 and earlier
ELECOM WAB-BE36-S v1.1.3 and earlier

Timeline

2026-05-12: advisory: Initial disclosure by JVN/JPCERT
2026-05-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.