ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken.

Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.<a href='https://cwe.mitre.org/data/definitions/321.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/288.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/78.html' target='_blank'></a> <a href='https://cwe.mitre.org/data/definitions/79.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/754.html' target='_blank'></a><a href='https://cwe.mitre.org/data/definitions/344.html' target='_blank'></a><ul><li>Use of Hard-coded Cryptographic Key in creating backup of configuration files (CWE-321) - CVE-2026-25107</li><li>OS command injection in processing of ping_ip_addr parameter (CWE-78) - CVE-2026-35506</li><li>Missing authentication when accepting in specific URLs (CWE-288) - CVE-2026-40621</li><li>OS command injection in processing of username parameter (CWE-78) - CVE-2026-42062</li><li>Stored cross-site scripting due to inadequate hostname parameter handling (CWE-79) - CVE-2026-42948</li><li>Missing Check for language parameter (CWE-754) - CVE-2026-42950</li><li>Inadequate CSRF protection (CWE-344) - CVE-2026-42961</li></ul>The vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer. CVE-2026-25107, CVE-2026-42950, CVE-2026-42961 Kentaro Ishii of GMO Cybersecur…