CVE-2026-42948 is a stored cross-site scripting vulnerability affecting ELECOM CO.,LTD. WAB-BE187-M wireless LAN access point devices running firmware version 1.1.10 or earlier. The vulnerability arises when an administrator inputs malicious data that is stored and later executed in the context of another administrator's web browser session, potentially allowing script execution with the privileges of the administrative user. The CVSS 3.0 base score is 4.8, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. No patch or official remediation guidance has been provided by the vendor as of the published date.

Successful exploitation could allow an attacker with administrative access to inject malicious scripts that execute in other administrators' browsers, potentially leading to limited confidentiality and integrity impacts within the administrative interface. There is no impact on availability reported. The vulnerability requires high privileges and user interaction, limiting its exploitation scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when inputting data into the device's management interface and limit administrative access to trusted personnel only.