CVE-2026-42961

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

May 13, 2026

CISA due date

—

The record

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations.

Affected packages

Ecosystem	Package	Introduced	Fixed