ELECOM wireless LAN access point devices do not validate the language parameter supplied to the web interface. If an authenticated user inadvertently visits a malicious web page, the language value can corrupt the admin page rendered in the browser, leaving the interface broken and unusable. This failure does not disclose data or allow code execution but effectively renders the management console inaccessible until the page is refreshed or the user logs out.

Affected products include ELECOM CO.,LTD. wireless LAN access points WAB-BE187-M, WAB-BE36-M, WAB-BE36-S, and WAB-BE72-M. No specific firmware version information is provided in the advisory, so all current and past revisions of these models are potentially impacted.

The CVSS score of 5.1 indicates a moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known exploited instances. The likely attack vector is client‑side: an authenticated user must be logged into the admin interface and then visit a malicious web page that supplies an invalid language parameter. Because the flaw does not provide direct control over the device, exploitation requires user interaction, but the resulting denial of service can disrupt management and maintenance operations.