CVE-2026-20704
Deferred Deferred - Pending Action
Cross-Site Request Forgery in WRC-X1500GS-B Router Enables Unauthorized Actions

Publication date: 2026-02-03

Last updated on: 2026-05-12

Assigner: JPCERT/CC

Description
Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-05-12
Generated
2026-06-16
AI Q&A
2026-02-03
EPSS Evaluated
2026-06-14
NVD
CVE-2026-20704
EUVD
EUVD-2026-5269
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
elecom wrc-x1500gs-b *
elecom wrc-x1500gsa-b to 1.12 (inc)
elecom wab-s733iw2-pd *
elecom wab-s733iw-ac *
elecom wab-s733iw-pd *
elecom wab-s300iw2-pd *
elecom wab-s300iw-ac *
elecom wab-s300iw-pd *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) affecting ELECOM wireless LAN products WRC-X1500GS-B and WRC-X1500GSA-B. It allows an attacker to trick a logged-in user into performing unintended operations by having them access a malicious webpage. Essentially, if a user is logged into the affected device and visits a malicious site, the attacker can cause actions to be executed on the device without the user's consent. [1]

Impact Analysis

The impact of this vulnerability is that an attacker can cause unintended operations on the affected device when a logged-in user accesses a malicious webpage. This could lead to unauthorized changes or actions being performed on the device, potentially compromising its security or functionality. [1]

Mitigation Strategies

Immediate mitigation steps include updating the firmware of affected ELECOM wireless LAN products to the latest versions provided by ELECOM for supported models. Discontinue use of unsupported models such as WAB-S733IW-PD and WAB-S300IW-PD. After updating, change the administrator and Wi-Fi passwords to strong, hard-to-guess credentials to prevent exploitation. [1]

Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart