CVE-2026-40621: ELECOM Wireless LAN Access Points: Authentication Bypass via Alternate Path (CWE-288)

Overview

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs, according to the CVE record. The affected product may therefore be operated without authentication. The weakness is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel.

Impact

The CNA JPCERT/CC rates the issue critical, with a CVSS 3.0 base score of 9.8 and a CVSS 4.0 base score of 9.3. The CVSS 3.0 vector lists network attack vector, low complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact. Based on the description, an attacker with network reach to an affected device could potentially access functions that should be protected. The exact functions exposed are not specified in the record.

Affected products and versions

The record does not list affected products, models or versions, and it does not list fixed versions. Consult the JVN advisory and the ELECOM security notice to confirm which products and firmware are impacted.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability recorded is 0.00722, with a percentile of 0.52758, which is an estimate of exploitation likelihood and not evidence of attacks.

Remediation and mitigation

Check the ELECOM notice and the JVN advisory for the affected model list and any firmware updates, and apply vendor guidance as soon as it is confirmed for your devices.
Inventory all ELECOM wireless access points, including those managed by third parties, and identify their firmware versions.
Restrict access to device management interfaces to trusted administrative networks, and avoid exposing them to the internet or untrusted segments.
Place wireless infrastructure in segmented networks so that a compromised access point has limited reach into sensitive systems.
Where a patch is not yet available, consider isolating or replacing affected devices according to your risk assessment.

Detection guidance

Review access logs of access points and management consoles for requests to administrative paths from unexpected sources, and for configuration changes without a corresponding authenticated session.
Monitor network traffic to wireless infrastructure for unusual management protocol activity from clients that should not manage these devices.
Compare device configurations against known good baselines to detect unauthorized changes.

Limitations of the available information

The record does not identify the specific URLs, affected models, firmware versions or fixed versions. It does not state whether a workaround exists beyond the general measures above. The EPSS date in the record is later than the publication date, so the score should be treated with caution. All technical details must be verified against the vendor and JVN advisories.

Frequently asked questions

What is CVE-2026-40621?

It is a critical issue in ELECOM wireless LAN access points, which do not require authentication to access some specific URLs, so the product may be operated without authentication.

How severe is it?

JPCERT/CC, the CNA, scores it 9.8 under CVSS 3.0 and 9.3 under CVSS 4.0, and classifies it as critical.

Is it known to be exploited?

The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.

Which versions are affected and which are fixed?

The record does not list affected or fixed versions. Check the ELECOM notice and the JVN advisory for that information.

What should administrators do now?

Inventory affected devices, follow vendor guidance when available, restrict management access to trusted networks, and monitor logs for unexpected administrative access.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.