CVE-2026-42950: Broken Admin Page in ELECOM WAB-BE187-M
Plattform
linux
Komponente
elecom-wab-be187-m
CVE-2026-42950 affects the ELECOM WAB-BE187-M Wireless LAN Access Point. This vulnerability allows an attacker to potentially break the administrative interface within a user's web browser by exploiting a lack of input validation on the language parameter. The vulnerability impacts versions 1.1.3 through 1.1.10. A firmware update is required to resolve this issue.
Auswirkungen und Angriffsszenarien
The primary impact of CVE-2026-42950 is the potential disruption of administrative access. While not a direct remote code execution vulnerability, a broken admin page could hinder network management and troubleshooting. An attacker could leverage this to create a denial-of-service condition for administrators, preventing them from making necessary configuration changes or monitoring network health. The blast radius is limited to the affected access points and the users who attempt to access the admin interface after being exposed to a malicious page. This vulnerability highlights the importance of proper input validation to prevent unexpected behavior and maintain system stability.
Ausnutzungskontext
CVE-2026-42950 was published on May 13, 2026. There is no indication of this vulnerability being actively exploited or listed on KEV/EPSS. The CVSS score of 4.3 (Medium) suggests a moderate probability of exploitation if a suitable attack vector is developed and widely distributed. Public proof-of-concept exploits are currently unavailable.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Keine — ohne Authentifizierung ausnutzbar. Keine Zugangsdaten erforderlich.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Unverändert — Auswirkung auf das anfällige Komponente beschränkt.
- Confidentiality
- Keine — kein Vertraulichkeitseinfluss.
- Integrity
- Keine — kein Integritätseinfluss.
- Availability
- Niedrig — partieller oder intermittierender Denial of Service.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
Mitigation und Workarounds
The recommended mitigation for CVE-2026-42950 is to upgrade the ELECOM WAB-BE187-M firmware to a version that addresses the vulnerability. Unfortunately, no specific workaround is provided beyond upgrading. Administrators should monitor network traffic for any unusual activity that might indicate exploitation attempts. Consider implementing stricter access controls to limit who can access the administrative interface and reduce the potential impact. After upgrading, confirm the admin page loads correctly and all functionalities are operational.
So behebenwird übersetzt…
Actualice el firmware del dispositivo ELECOM WAB-BE187-M a una versión corregida. Consulte el sitio web de ELECOM para obtener las últimas actualizaciones de firmware y las instrucciones de instalación. La falta de validación del parámetro de idioma permite la exposición de la página de administración, por lo que es crucial aplicar la actualización para mitigar el riesgo.
Häufig gestellte Fragen
What is CVE-2026-42950 — Broken Admin Page in ELECOM WAB-BE187-M?
CVE-2026-42950 describes a vulnerability in the ELECOM WAB-BE187-M access point where a malicious page can break the admin interface. It's rated as medium severity (CVSS 4.3) and affects versions 1.1.3–v1.1.10.
Am I affected by CVE-2026-42950 in ELECOM WAB-BE187-M?
You are affected if you are using the ELECOM WAB-BE187-M access point with firmware versions 1.1.3 through 1.1.10. Check your device's firmware version to determine if you are vulnerable.
How do I fix CVE-2026-42950 in ELECOM WAB-BE187-M?
The recommended fix is to upgrade the firmware to a patched version. Consult the ELECOM website or support channels for available firmware updates.
Is CVE-2026-42950 being actively exploited?
Currently, there is no public information indicating that CVE-2026-42950 is being actively exploited. However, it's crucial to apply the patch to mitigate potential future attacks.
Where can I find the official ELECOM advisory for CVE-2026-42950?
Please refer to the ELECOM support website or contact their technical support team for the official advisory regarding CVE-2026-42950 and available firmware updates.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...