CVE-2026-25107

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knows the encryption key can tamper the configuration file of the product, and a victim administrator may be tricked to use a crafted configuration file.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-321

Affected software

VendorProductVersions
ELECOM CO.,LTD.WRC-X1800GS-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X3000GS2-Bv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GS2-Wv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GS2A-Bv1.09 and earlier
ELECOM CO.,LTD.WRC-X3000GST2-Bv1.06 and earlier
ELECOM CO.,LTD.WRC-X1800GSA-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X1800GSH-Bv1.19 and earlier
ELECOM CO.,LTD.WRC-X6000QS-Gv1.14 and earlier
ELECOM CO.,LTD.WRC-X6000QSA-Gv1.14 and earlier
ELECOM CO.,LTD.WRC-X6000XS-Gv1.12 and earlier
ELECOM CO.,LTD.WRC-X6000XST-Gv1.16 and earlier
ELECOM CO.,LTD.WRC-XE5400GS-G1.13 and earlier
ELECOM CO.,LTD.WRC-XE5400GSA-Gv1.13 and earlier

References

Timeline

Published
May 13, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-251088.8FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciallCVE-2026-251098.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-25117.5The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameterCVE-2026-251103.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-251118.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote coCVE-2026-251127.8A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.CVE-2026-251139.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251149.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting CVE-2026-251159.9n8n is an open source workflow automation platform. Prior to version 2.4.8, a vulnerability in the Python Code node allows authenticated useCVE-2026-251168.8Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated Path Traversal vulneCVE-2026-251178.3pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandCVE-2026-251187.5immich is a high performance self-hosted photo and video management solution. Prior to version 2.6.0, the Immich application is vulnerable t
CVE-2026-25107: Medium severity, CVSS 6.9 | Vulnix