CVE-2026-20704

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

Metrics

CVSS 4.0 5.1/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
ELECOM CO.,LTD.WRC-X1500GS-Bv1.12 and earlier
ELECOM CO.,LTD.WRC-X1500GSA-Bv1.12 and earlier
ELECOM CO.,LTD.WRC-X3000GS2-Bv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GS2-Wv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GS2A-Bv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GST2-Bv1.06 and earlier
ELECOM CO.,LTD.WRC-X1800GS-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X1800GSA-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X1800GSH-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X6000QS-Gv1.14 and earlier
ELECOM CO.,LTD.WRC-X6000QSA-Gv1.14 and earlier
ELECOM CO.,LTD.WRC-X6000XS-Gv1.12 and earlier
ELECOM CO.,LTD.WRC-X6000XST-Gv1.16 and earlier
ELECOM CO.,LTD.WRC-XE5400GS-Gv1.13 and earlier
ELECOM CO.,LTD.WRC-XE5400GSA-Gv1.13 and earlier

References

Timeline

Published
Feb 3, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-207055.3Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow informCVE-2026-207069.1Gitea versions up to and including 1.26.1 allow repository archive downloads to bypass token scope checks on the web archive download endpoiCVE-2026-207075.6Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivileged software may allowCVE-2026-207085.9Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an infoCVE-2026-207096.6Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver Series, Intel(R) Celeron(R) Processor J SerieCVE-2026-20718.8A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formP2PLimitConfig. PCVE-2026-207116.1Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitraryCVE-2026-207124.0Incomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may allow an information disclosure. System softwCVE-2026-207137.5Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalation of privilege. SysCVE-2026-207147.8Out-of-bounds write for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a escaCVE-2026-207158.2Improper input validation in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT) and some Intel(R) Standard ManageabCVE-2026-207167.0Improper access control for some Intel(R) Processors within Ring 3: User Applications may allow an escalation of privilege. Simple hardware
CVE-2026-20704: Medium severity, CVSS 5.1 | Vulnix