CVE-2026-42961: ELECOM Wireless LAN Access Points CSRF in management interface

CVE-2026-42961 · Severity: medium · CVSS 4.3 · Published 2026-05-13

ELECOM wireless LAN access points are affected by a security flaw in how they verify administrative requests. If an authenticated administrator visits a malicious website, an attacker could trick their browser into performing unauthorized configuration changes on the device. This could lead to unauthorized modifications of network settings or other administrative actions without the user's consent.

Technologies: Elecom WAB-BE187-M, Elecom WAB-BE36-M, Elecom WAB-BE36-S, Elecom WAB-BE72-M. Vendors: Elecom.

Quick answers

Is CVE-2026-42961 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42961 being exploited in the wild.
How severe is CVE-2026-42961?
Medium severity, with a CVSS score of 4.3, published 13 May 2026.
Which products and versions are affected?
Elecom WAB-BE187-M v1.1.10 and earlier; Elecom WAB-BE36-M v1.1.3 and earlier; Elecom WAB-BE36-S v1.1.3 and earlier; Elecom WAB-BE72-M v1.1.3 and earlier.
Is there a fix for CVE-2026-42961?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42961 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42961?
Check whether you run Elecom WAB-BE187-M, Elecom WAB-BE36-M, Elecom WAB-BE36-S or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a Cross-Site Request Forgery (CSRF) resulting from the use of an invariant value in a dynamically changing context (CWE-344). While the affected ELECOM wireless LAN access points implement a CSRF protection mechanism, the handling of CSRF tokens is inadequate, allowing for predictable or static values that do not sufficiently validate the origin of the request. An attacker can exploit this by hosting a malicious page that sends unauthorized requests to the device's management interface. If an administrator with an active session visits the malicious page, the device will process the attacker's requests as if they were legitimate, potentially leading to unauthorized configuration changes. Users are advised to update to the latest firmware versions provided by the vendor.

Affected products

  • ELECOM WAB-BE187-M v1.1.10 and earlier
  • ELECOM WAB-BE72-M v1.1.3 and earlier
  • ELECOM WAB-BE36-M v1.1.3 and earlier
  • ELECOM WAB-BE36-S v1.1.3 and earlier

Timeline

  • 2026-05-12: advisory: Initial advisory published by JVN/JPCERT
  • 2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.