CVE-2026-42948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42948", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-05-07T05:47:09.922Z", "datePublished": "2026-05-13T12:02:03.914Z", "dateUpdated": "2026-05-13T15:06:33.320Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE187-M", "versions": [{"version": "v1.1.10 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE72-M", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-M", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-S", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en-US", "cweId": "CWE-79", "type": "CWE"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:02:03.914Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:06:22.585437Z", "id": "CVE-2026-42948", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:06:33.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42948", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:06:22.585437Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:06:27.116Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE187-M", "versions": [{"status": "affected", "version": "v1.1.10 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE72-M", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-M", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-S", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site scripting (XSS)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:02:03.914Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42948", "state": "PUBLISHED", "dateUpdated": "2026-05-13T15:06:33.320Z", "dateReserved": "2026-05-07T05:47:09.922Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-05-13T12:02:03.914Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WAB-BE187-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.10 and earlier"}]}, {"product": "WAB-BE72-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"product": "WAB-BE36-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"product": "WAB-BE36-S", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices. If one of the administrators input malicious data, an arbitrary script may be executed in another administrative user's web browser."}, {"lang": "es", "value": "Vulnerabilidad de cross-site scripting almacenado existe en los dispositivos de punto de acceso LAN inal\u00e1mbrica de ELECOM. Si uno de los administradores introduce datos maliciosos, un script arbitrario puede ser ejecutado en el navegador web de otro usuario administrativo."}], "id": "CVE-2026-42948", "lastModified": "2026-10-26T00:10:00.150", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42948", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T15:06:22.585437Z", "version": "2.0.3"}}]}, "published": "2026-05-13T13:16:44.063", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN03037325/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.elecom.co.jp/news/security/20260512-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE187-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be187-m", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE36-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be36-m", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE36-S", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be36-s", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE72-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be72-m", "vendor": "elecom"}], "created": "2026-05-13T15:00:06.655425+00:00", "title": "Stored XSS Vulnerability in ELECOM Wireless Access Point Administration Interface", "updated": "2026-05-17T19:42:01.461535+00:00", "vendors": ["elecom", "elecom$PRODUCT$wab-be187-m", "elecom$PRODUCT$wab-be36-m", "elecom$PRODUCT$wab-be36-s", "elecom$PRODUCT$wab-be72-m"]}