ELECOM wireless LAN access point devices contain a stored cross‑site scripting flaw in their administrative web interface. When an administrator enters malicious data, that data is stored and later executed in the web browser of another administrator who visits the same page, allowing arbitrary client‑side code execution, phishing, or credential theft. The issue has a CVSS score of 4.8, indicating moderate severity, and no EPSS data is available.

The affected devices are ELECOM CO.,LTD. wireless access points models WAB‑BE187‑M, WAB‑BE36‑M, WAB‑BE36‑S, and WAB‑BE72‑M. No specific firmware or version details are supplied.

The vulnerability is reachable through the local or internal network where the administrative interface is accessible. Exploitation requires an authenticated or associated administrator to be logged in or to have the ability to reach the admin interface. The CVSS score of 4.8 reflects moderate impact; the absence of an EPSS score and its non‑listing in CISA KEV suggest limited known exploitation activity.