CVE-2026-42948
- State
- Published
- Severity
- 4.8 Medium
- Published
- May 13, 2026
- Updated
- May 13, 2026
- Reserved
- May 7, 2026
Description
Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | jpcert |
| 3.0 | 4.8 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | jpcert |
Weaknesses
- CWE-79 Cross-site scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
WAB-BE187-MELECOM CO.,LTD. |
|
WAB-BE72-MELECOM CO.,LTD. |
|
WAB-BE36-MELECOM CO.,LTD. |
|
WAB-BE36-SELECOM CO.,LTD. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.