Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.

Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser.

Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/321.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/288.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/754.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/344.html' target='_blank'></a><ul><li>Use of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107</li><li>OS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506</li><li>Missing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621</li><li>OS command injection in processing of username parameter (CWE-78) - CVE-2026-42062</li><li>Stored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948</li><li>Missing Check for language parameter (CWE-754) - CVE-2026-42950</li><li>Inadequate CSRF protection (CWE-344) - CVE-2026-42961</li></ul>The vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer. CVE-2026-25107, CVE-2026-42950, CVE-2026-42961 Kentaro Ishii of GMO Cybersecur…