CVE-2026-25107

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25107", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-05-07T05:47:06.075Z", "datePublished": "2026-05-13T12:01:20.724Z", "dateUpdated": "2026-05-13T18:26:26.218Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GS-B", "versions": [{"version": "v1.19 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"version": "v1.09 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"version": "v1.09 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"version": "v1.09 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GST2-B", "versions": [{"version": "v1.06 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GSA-B", "versions": [{"version": "v1.19 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GSH-B", "versions": [{"version": "v1.19 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000QS-G", "versions": [{"version": "v1.14 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000QSA-G", "versions": [{"version": "v1.14 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XS-G", "versions": [{"version": "v1.12 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XST-G", "versions": [{"version": "v1.16 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-XE5400GS-G", "versions": [{"version": "1.13 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-XE5400GSA-G", "versions": [{"version": "v1.13 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file."}], "problemTypes": [{"descriptions": [{"description": "Use of hard-coded cryptographic key", "lang": "en-US", "cweId": "CWE-321", "type": "CWE"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:01:20.724Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T18:26:16.594153Z", "id": "CVE-2026-25107", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T18:26:26.218Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25107", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T18:26:16.594153Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T18:26:22.969Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GS-B", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GST2-B", "versions": [{"status": "affected", "version": "v1.06 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GSA-B", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1800GSH-B", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000QS-G", "versions": [{"status": "affected", "version": "v1.14 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000QSA-G", "versions": [{"status": "affected", "version": "v1.14 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XS-G", "versions": [{"status": "affected", "version": "v1.12 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XST-G", "versions": [{"status": "affected", "version": "v1.16 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-XE5400GS-G", "versions": [{"status": "affected", "version": "1.13 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-XE5400GSA-G", "versions": [{"status": "affected", "version": "v1.13 and earlier"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-321", "description": "Use of hard-coded cryptographic key"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:01:20.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25107", "state": "PUBLISHED", "dateUpdated": "2026-05-13T18:26:26.218Z", "dateReserved": "2026-05-07T05:47:06.075Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-05-13T12:01:20.724Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WRC-X1800GS-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"product": "WRC-X3000GS2-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"product": "WRC-X3000GS2-W", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"product": "WRC-X3000GS2A-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.09 and earlier"}]}, {"product": "WRC-X3000GST2-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.06 and earlier"}]}, {"product": "WRC-X1800GSA-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"product": "WRC-X1800GSH-B", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.19 and earlier"}]}, {"product": "WRC-X6000QS-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.14 and earlier"}]}, {"product": "WRC-X6000QSA-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.14 and earlier"}]}, {"product": "WRC-X6000XS-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.12 and earlier"}]}, {"product": "WRC-X6000XST-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.16 and earlier"}]}, {"product": "WRC-XE5400GS-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "1.13 and earlier"}]}, {"product": "WRC-XE5400GSA-G", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.13 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file."}, {"lang": "es", "value": "Los dispositivos de punto de acceso LAN inal\u00e1mbrica ELECOM utilizan una clave criptogr\u00e1fica codificada de forma r\u00edgida al crear copias de seguridad de archivos de configuraci\u00f3n. Un atacante que conoce la clave de cifrado puede manipular el archivo de configuraci\u00f3n del producto, y un administrador v\u00edctima puede ser enga\u00f1ado para usar un archivo de configuraci\u00f3n manipulado."}], "id": "CVE-2026-25107", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25107", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T18:26:16.594153Z", "version": "2.0.3"}}]}, "published": "2026-05-13T13:16:37.160", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN03037325/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.elecom.co.jp/news/security/20260512-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.19 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X1800GS-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x1800gs-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.19 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X1800GSA-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x1800gsa-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.19 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X1800GSH-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x1800gsh-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.09 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X3000GS2-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x3000gs2-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.06 and earlier"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "WRC-X3000GST2-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x3000gs2-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.09 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X3000GS2-W", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x3000gs2-w", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.09 and earlier"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "WRC-X3000GS2A-B", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x3000gs2a-b", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.14 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WRC-X6000QS-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x6000qs-g", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.14 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WRC-X6000QSA-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x6000qsa-g", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.12 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X6000XS-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x6000xs-g", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.16 and earlier"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "WRC-X6000XST-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-x6000xst-g", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.13 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WRC-XE5400GS-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-xe5400gs-g", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.13 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WRC-XE5400GSA-G", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wrc-xe5400gsa-g", "vendor": "elecom"}], "created": "2026-05-13T15:00:06.655720+00:00", "updated": "2026-05-17T19:42:05.570364+00:00", "vendors": ["elecom", "elecom$PRODUCT$wrc-x1800gs-b", "elecom$PRODUCT$wrc-x1800gsa-b", "elecom$PRODUCT$wrc-x1800gsh-b", "elecom$PRODUCT$wrc-x3000gs2-b", "elecom$PRODUCT$wrc-x3000gs2-w", "elecom$PRODUCT$wrc-x3000gs2a-b", "elecom$PRODUCT$wrc-x6000qs-g", "elecom$PRODUCT$wrc-x6000qsa-g", "elecom$PRODUCT$wrc-x6000xs-g", "elecom$PRODUCT$wrc-x6000xst-g", "elecom$PRODUCT$wrc-xe5400gs-g", "elecom$PRODUCT$wrc-xe5400gsa-g"]}