CVE-2026-42950

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42950", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2026-05-07T05:47:10.836Z", "datePublished": "2026-05-13T12:02:12.851Z", "dateUpdated": "2026-05-13T15:05:49.437Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE187-M", "versions": [{"version": "v1.1.10 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE72-M", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-M", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-S", "versions": [{"version": "v1.1.3 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken."}], "problemTypes": [{"descriptions": [{"description": "Improper check for unusual or exceptional conditions", "lang": "en-US", "cweId": "CWE-754", "type": "CWE"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:02:12.851Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T15:05:24.135095Z", "id": "CVE-2026-42950", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:05:49.437Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42950", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:05:24.135095Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T15:05:43.216Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE187-M", "versions": [{"status": "affected", "version": "v1.1.10 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE72-M", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-M", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WAB-BE36-S", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20260512-01/"}, {"url": "https://jvn.jp/en/jp/JVN03037325/"}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-754", "description": "Improper check for unusual or exceptional conditions"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2026-05-13T12:02:12.851Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42950", "state": "PUBLISHED", "dateUpdated": "2026-05-13T15:05:49.437Z", "dateReserved": "2026-05-07T05:47:10.836Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2026-05-13T12:02:12.851Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WAB-BE187-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.10 and earlier"}]}, {"product": "WAB-BE72-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"product": "WAB-BE36-M", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}, {"product": "WAB-BE36-S", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "v1.1.3 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken."}, {"lang": "es", "value": "Los dispositivos de punto de acceso LAN inal\u00e1mbrica ELECOM no verifican si el par\u00e1metro de idioma tiene un valor apropiado. Si un usuario visualiza una p\u00e1gina maliciosa mientras est\u00e1 conectado, la p\u00e1gina de administraci\u00f3n en el navegador web del usuario puede quedar da\u00f1ada."}], "id": "CVE-2026-42950", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42950", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T15:05:24.135095Z", "version": "2.0.3"}}]}, "published": "2026-05-13T13:16:44.200", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN03037325/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.elecom.co.jp/news/security/20260512-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.1.10 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE187-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be187-m", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.1.3 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE36-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be36-m", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.1.3 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE36-S", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be36-s", "vendor": "elecom"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.1.3 and earlier"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WAB-BE72-M", "source": "cna", "vendor": "ELECOM CO.,LTD."}, "product": "wab-be72-m", "vendor": "elecom"}], "created": "2026-05-13T14:30:36.171448+00:00", "title": "Elecom Wireless LAN Access Point Language Parameter Validation Failure Causing Admin Page Breakage", "updated": "2026-05-17T19:42:00.143049+00:00", "vendors": ["elecom", "elecom$PRODUCT$wab-be187-m", "elecom$PRODUCT$wab-be36-m", "elecom$PRODUCT$wab-be36-s", "elecom$PRODUCT$wab-be72-m"]}