CVE-2026-20704

Deferred Deferred - Pending Action

Cross-Site Request Forgery in WRC-X1500GS-B Router Enables Unauthorized Actions

Publication date: 2026-02-03

Last updated on: 2026-05-12

Assigner: JPCERT/CC

Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-03

Last Modified

2026-05-12

Generated

2026-07-06

AI Q&A

2026-02-04

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20704

EUVD

EUVD-2026-5269

Affected Vendors & Products

Vendor	Product	Version / Range
elecom	wrc-x1500gs-b	*
elecom	wrc-x1500gsa-b	to 1.12 (inc)
elecom	wab-s733iw2-pd	*
elecom	wab-s733iw-ac	*
elecom	wab-s733iw-pd	*
elecom	wab-s300iw2-pd	*
elecom	wab-s300iw-ac	*
elecom	wab-s300iw-pd	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Compliance Impact

I don't know

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) affecting ELECOM wireless LAN products WRC-X1500GS-B and WRC-X1500GSA-B. It allows an attacker to trick a logged-in user into performing unintended operations by having them access a malicious webpage. Essentially, if a user is logged into the affected device and visits a malicious site, the attacker can cause actions to be executed on the device without the user's consent. [1]

Impact Analysis

The impact of this vulnerability is that an attacker can cause unintended operations on the affected device when a logged-in user accesses a malicious webpage. This could lead to unauthorized changes or actions being performed on the device, potentially compromising its security or functionality. [1]

Mitigation Strategies

Immediate mitigation steps include updating the firmware of affected ELECOM wireless LAN products to the latest versions provided by ELECOM for supported models. Discontinue use of unsupported models such as WAB-S733IW-PD and WAB-S300IW-PD. After updating, change the administrator and Wi-Fi passwords to strong, hard-to-guess credentials to prevent exploitation. [1]

Detection Guidance

I don't know

Hi! I’m here to help you understand CVE-2026-20704. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70