CVE-2026-42062Critical 9.8ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter. If processing a crafted request, an arbitrary OS command may be executed. No authenticatio1.6%
CVE-2026-40621Critical 9.8ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.0.5%
CVE-2026-35506High 7.2ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary O1.3%