CVE-2026-42948: XSS in ELECOM WAB-BE187-M Access Point
Plattform
other
Komponente
elecom-wab-be187-m
CVE-2026-42948 describes a stored cross-site scripting (XSS) vulnerability present in the ELECOM WAB-BE187-M Wireless LAN Access Point. This vulnerability allows an attacker to inject malicious scripts if an administrator inputs crafted data. Successful exploitation could lead to arbitrary script execution within the web browser of another administrative user, potentially compromising account credentials or system configurations. The vulnerability affects versions 1.1.3 through 1.1.10 and a fix is pending.
Auswirkungen und Angriffsszenarien
The primary impact of this XSS vulnerability lies in the potential for unauthorized code execution within the administrative interface of the ELECOM WAB-BE187-M Access Point. An attacker could leverage this to steal session cookies, redirect administrators to phishing sites, or even modify the access point's configuration. The ability to execute arbitrary JavaScript code opens the door to a wide range of malicious activities, including data exfiltration and denial-of-service attacks. Given the access point's role in network connectivity, a successful compromise could have a significant impact on the entire network.
Ausnutzungskontext
CVE-2026-42948 was published on May 13, 2026. Its severity is rated as Medium. No public exploits or active campaigns targeting this vulnerability have been observed as of the publication date. The vulnerability is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Monitor security advisories from ELECOM for updates.
Bedrohungsanalyse
Exploit-Status
CISA SSVC
CVSS-Vektor
Was bedeuten diese Metriken?
- Attack Vector
- Netzwerk — aus der Ferne über das Internet ausnutzbar. Kein physischer oder lokaler Zugriff erforderlich.
- Attack Complexity
- Niedrig — keine besonderen Bedingungen erforderlich. Zuverlässig ausnutzbar.
- Privileges Required
- Hoch — Administrator- oder Privilegienkonto erforderlich.
- User Interaction
- Erforderlich — Opfer muss eine Datei öffnen, auf einen Link klicken oder eine Seite besuchen.
- Scope
- Geändert — Angriff kann über die anfällige Komponente hinaus auf andere Systeme übergreifen.
- Confidentiality
- Niedrig — partieller oder indirekter Zugriff auf einige Daten.
- Integrity
- Niedrig — Angreifer kann einige Daten mit begrenztem Umfang ändern.
- Availability
- Keine — kein Verfügbarkeitseinfluss.
Betroffene Software
Schwachstellen-Klassifikation (CWE)
Zeitleiste
- Reserviert
- Veröffentlicht
Mitigation und Workarounds
Currently, no specific patched version is available to directly address CVE-2026-42948. As a temporary mitigation, implement strict input validation and sanitization on all administrator input fields within the WAB-BE187-M's web interface. Consider deploying a Web Application Firewall (WAF) with XSS filtering rules to block malicious payloads. Regularly review access point logs for suspicious activity, specifically looking for unusual script execution patterns. Until a patch is released, limiting administrative access and enforcing strong password policies are crucial.
So behebenwird übersetzt…
Actualice el firmware del dispositivo ELECOM WAB-BE187-M a una versión corregida. Consulte la página de soporte de ELECOM para obtener más información sobre las actualizaciones de firmware disponibles: https://www.elecom.co.jp/news/security/20260512-01/
Häufig gestellte Fragen
What is CVE-2026-42948 — XSS in ELECOM WAB-BE187-M?
CVE-2026-42948 is a stored cross-site scripting vulnerability in the ELECOM WAB-BE187-M Wireless LAN Access Point, allowing attackers to inject malicious scripts through administrator input.
Am I affected by CVE-2026-42948 in ELECOM WAB-BE187-M?
You are affected if you are using the ELECOM WAB-BE187-M Access Point with versions 1.1.3 through 1.1.10.
How do I fix CVE-2026-42948 in ELECOM WAB-BE187-M?
A patch is pending. Mitigate by implementing input validation, WAF rules, and monitoring logs until a fix is released.
Is CVE-2026-42948 being actively exploited?
No active exploitation campaigns have been observed as of the publication date, but vigilance is still required.
Where can I find the official ELECOM advisory for CVE-2026-42948?
Refer to the ELECOM website and security advisories for updates regarding this vulnerability.
Ist dein Projekt betroffen?
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Jetzt testen — kein Konto
Laden Sie ein Manifest hoch (composer.lock, package-lock.json, WordPress Plugin-Liste…) oder fügen Sie Ihre Komponentenliste ein. Sie erhalten sofort einen Schwachstellenbericht. Das Hochladen einer Datei ist nur der Anfang: Mit einem Konto erhalten Sie kontinuierliche Überwachung, Slack/email-Benachrichtigungen, Multi-Projekt- und White-Label-Berichte.
Abhängigkeitsdatei hier ablegen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...