CVE-2026-20704

Severity: medium (CVSS 5.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-03 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN products. If a user accesses a malicious page while logged-in to the affected product, unintended operations may be performed.

Affected products

ELECOM CO.,LTD. WRC-X1500GS-B: through v1.12
ELECOM CO.,LTD. WRC-X1500GSA-B: through v1.12
ELECOM CO.,LTD. WRC-X1800GS-B: through v1.19
ELECOM CO.,LTD. WRC-X1800GSA-B: through v1.19
ELECOM CO.,LTD. WRC-X1800GSH-B: through v1.19
ELECOM CO.,LTD. WRC-X3000GS2-B: through v1.09
ELECOM CO.,LTD. WRC-X3000GS2-W: through v1.09
ELECOM CO.,LTD. WRC-X3000GS2A-B: through v1.09
ELECOM CO.,LTD. WRC-X3000GST2-B: through v1.06
ELECOM CO.,LTD. WRC-X6000QS-G: through v1.14
ELECOM CO.,LTD. WRC-X6000QSA-G: through v1.14
ELECOM CO.,LTD. WRC-X6000XS-G: through v1.12
ELECOM CO.,LTD. WRC-X6000XST-G: through v1.16
ELECOM CO.,LTD. WRC-XE5400GS-G: through v1.13
ELECOM CO.,LTD. WRC-XE5400GSA-G: through v1.13

References

Get alerted when CVE-2026-20704 or the next vulnerability affects your stack