« Volver al listado

CVE-2026-20704

Estado: AplazadaMedia (5.1)—

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Elecom — Wireless LANAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-20704",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20704",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-03T15:55:57.052296Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X1500GS-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X1500GSA-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X3000GS2-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X3000GS2-W",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X3000GS2A-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.09 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X3000GST2-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.06 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X1800GS-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X1800GSA-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X1800GSH-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.19 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X6000QS-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X6000QSA-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.14 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X6000XS-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.12 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X6000XST-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.16 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-XE5400GS-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-XE5400GSA-G",
          "versions": [
            {
              "status": "affected",
              "version": "v1.13 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-03T07:16:12.503",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN94012927/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.elecom.co.jp/news/security/20260203-01/",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de falsificación de petición en sitios cruzados en WRC-X1500GS-B y WRC-X1500GSA-B. Si un usuario accede a una página maliciosa mientras está conectado al producto afectado, se pueden realizar operaciones no deseadas."
    }
  ],
  "lastModified": "2026-06-17T10:17:43.737",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}