The vulnerability arises from an incorrect implementation of the CSRF protection mechanism in ELECOM wireless LAN access points, allowing an attacker to trick a logged‑in user into performing unintended configuration actions while visiting a malicious webpage. The flaw can lead to unauthorized modification of device settings, compromising the integrity of the device’s configuration, but it does not directly enable remote code execution.

Affected products are ELECOM CO.,LTD. wireless LAN access points model WAB‑BE187‑M, WAB‑BE36‑M, WAB‑BE36‑S, and WAB‑BE72‑M. No specific firmware version is listed, so any firmware with the flawed CSRF handling may be vulnerable.

The CVSS score of 5.1 indicates a medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploits are not publicly documented. Nevertheless, an attacker can exploit this vulnerability by having the user authenticated to the device’s web interface and then visiting a malicious site, thereby causing the device to perform unauthorized operations. The risk of exploitation exists as soon as an authenticated user actively browses the web and should be mitigated promptly.