All the vulnerabilites related to ELECOM CO.,LTD. - WAB-I1750-PS
jvndb-2023-002797
Vulnerability from jvndb
Published
2023-08-15 11:54
Modified
2024-08-29 09:39
Severity ?
Summary
Multiple vulnerabilities in ELECOM and LOGITEC network devices
Details
Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below.
* Hidden Functionality (CWE-912) - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445
* Telnet service access restriction failure (CWE-284) - CVE-2023-38132
* Hidden Functionality (CWE-912) - CVE-2023-38576
* Buffer overflow (CWE-120) - CVE-2023-39454
* OS Command Injection (CWE-78) - CVE-2023-39455, CVE-2023-40072
* OS Command Injection (CWE-78) - CVE-2023-39944, CVE-2023-40069
Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002797.html", "dc:date": "2024-08-29T09:39+09:00", "dcterms:issued": "2023-08-15T11:54+09:00", "dcterms:modified": "2024-08-29T09:39+09:00", "description": "Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below.\r\n\r\n * Hidden Functionality (CWE-912) - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445\r\n * Telnet service access restriction failure (CWE-284) - CVE-2023-38132\r\n * Hidden Functionality (CWE-912) - CVE-2023-38576\r\n * Buffer overflow (CWE-120) - CVE-2023-39454\r\n * OS Command Injection (CWE-78) - CVE-2023-39455, CVE-2023-40072\r\n * OS Command Injection (CWE-78) - CVE-2023-39944, CVE-2023-40069\r\n\r\nChuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.", "link": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002797.html", "sec:cpe": [ { "#text": "cpe:/a:elecom:wab-i1750-ps", "@product": "WAB-I1750-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/a:elecom:wab-s1167-ps", "@product": "WAB-S1167-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-m1775-ps_firmware", "@product": "WAB-M1775-PS firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-m2133_firmware", "@product": "WAB-M2133 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-s1167_firmware", "@product": "WAB-S1167 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-s1775_firmware", "@product": "WAB-S1775 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-s300_firmware", "@product": "WAB-S300", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wab-s600-ps_firmware", "@product": "WAB-S600-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1167ghbk2_firmware", "@product": "WRC-1167GHBK2 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1467ghbk-a_firmware", "@product": "WRC-1467GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1467ghbk-s_firmware", "@product": "WRC-1467GHBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1750ghbk-e_firmware", "@product": "WRC-1750GHBK-E firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1750ghbk2-i_firmware", "@product": "WRC-1750GHBK2-I firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1750ghbk_firmware", "@product": "WRC-1750GHBK firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1900ghbk-a_firmware", "@product": "WRC-1900GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-1900ghbk-s_firmware", "@product": "WRC-1900GHBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-600ghbk-a_firmware", "@product": "WRC-600GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-733febk2-a_firmware", "@product": "WRC-733FEBK2-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-f1167acf2_firmware", "@product": "WRC-F1167ACF2", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-f1167acf_firmware", "@product": "WRC-F1167ACF firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x1800gs-b_firmware", "@product": "WRC-X1800GS-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x1800gsa-b_firmware", "@product": "WRC-X1800GSA-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x1800gsh-b_firmware", "@product": "WRC-X1800GSH-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-w300n%2fdr_firmware", "@product": "LAN-W300N/DR", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-w300n%2fpr5_firmware", "@product": "LAN-W300N/PR5", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-w300n%2fp_firmware", "@product": "LAN-W300N/P firmware", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-w300n%2frs_firmware", "@product": "LAN-W300N/RS firmware", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-w451ngr_firmware", "@product": "LAN-W451NGR", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh300an%2fdgp_firmware", "@product": "LAN-WH300AN/DGP", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh300andgpe_firmware", "@product": "LAN-WH300ANDGPE", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh300n%2fdgp_firmware", "@product": "LAN-WH300N/DGP firmware", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh300n%2fdr_firmware", "@product": "LAN-WH300N/DR", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh300n%2fre_firmware", "@product": "LAN-WH300N/RE", "@vendor": "Logitec Corp.", "@version": "2.2" }, { "#text": "cpe:/o:logitec:lan-wh450n%2fgp_firmware", "@product": "LAN-WH450N/GP", "@vendor": "Logitec Corp.", "@version": "2.2" } ], "sec:cvss": [ { "@score": "5.8", "@severity": "Medium", "@type": "Base", "@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "@version": "2.0" }, { "@score": "8.8", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0" } ], "sec:identifier": "JVNDB-2023-002797", "sec:references": [ { "#text": "http://jvn.jp/en/vu/JVNVU91630351/index.html", "@id": "JVNVU#91630351", "@source": "JVN" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-32626", "@id": "CVE-2023-32626", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-35991", "@id": "CVE-2023-35991", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-38132", "@id": "CVE-2023-38132", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-38576", "@id": "CVE-2023-38576", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39445", "@id": "CVE-2023-39445", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39454", "@id": "CVE-2023-39454", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39455", "@id": "CVE-2023-39455", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39944", "@id": "CVE-2023-39944", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40069", "@id": "CVE-2023-40069", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40072", "@id": "CVE-2023-40072", "@source": "CVE" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32626", "@id": "CVE-2023-32626", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-35991", "@id": "CVE-2023-35991", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-38132", "@id": "CVE-2023-38132", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-38576", "@id": "CVE-2023-38576", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39445", "@id": "CVE-2023-39445", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39454", "@id": "CVE-2023-39454", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39455", "@id": "CVE-2023-39455", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39944", "@id": "CVE-2023-39944", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40069", "@id": "CVE-2023-40069", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40072", "@id": "CVE-2023-40072", "@source": "NVD" }, { "#text": "https://cwe.mitre.org/data/definitions/120.html", "@id": "CWE-120", "@title": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)(CWE-120)" }, { "#text": "https://cwe.mitre.org/data/definitions/284.html", "@id": "CWE-284", "@title": "Improper Access Control(CWE-284)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-78", "@title": "OS Command Injection(CWE-78)" }, { "#text": "https://cwe.mitre.org/data/definitions/912.html", "@id": "CWE-912", "@title": "Hidden Functionality(CWE-912)" } ], "title": "Multiple vulnerabilities in ELECOM and LOGITEC network devices" }
jvndb-2024-000088
Vulnerability from jvndb
Published
2024-08-27 14:40
Modified
2024-08-27 14:40
Severity ?
Summary
Multiple vulnerabilities in ELECOM wireless LAN routers and access points
Details
Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.
* Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi (CWE-79) - CVE-2024-34577, CVE-2024-42412
* Missing authentication in Telnet function (CWE-306) - CVE-2024-39300
* Stack-based buffer overflow due to an improper processing of input values in common.cgi (CWE-121) - CVE-2024-43689
CVE-2024-34577
Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2024-39300
SASABE Tetsuro reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2024-42412, CVE-2024-43689
RyotaK of Flatt Security Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
▼ | Type | URL |
---|---|---|
JVN | https://jvn.jp/en/jp/JVN24885537/index.html | |
CVE | https://www.cve.org/CVERecord?id=CVE-2024-34577 | |
CVE | https://www.cve.org/CVERecord?id=CVE-2024-39300 | |
CVE | https://www.cve.org/CVERecord?id=CVE-2024-42412 | |
CVE | https://www.cve.org/CVERecord?id=CVE-2024-43689 | |
Buffer Errors(CWE-119) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
Cross-site Scripting(CWE-79) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
No Mapping(CWE-Other) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000088.html", "dc:date": "2024-08-27T14:40+09:00", "dcterms:issued": "2024-08-27T14:40+09:00", "dcterms:modified": "2024-08-27T14:40+09:00", "description": "Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\n* Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi (CWE-79) - CVE-2024-34577, CVE-2024-42412\r\n\r\n* Missing authentication in Telnet function (CWE-306) - CVE-2024-39300\r\n\r\n* Stack-based buffer overflow due to an improper processing of input values in common.cgi (CWE-121) - CVE-2024-43689\r\n\r\nCVE-2024-34577\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-39300\r\nSASABE Tetsuro reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-42412, CVE-2024-43689\r\nRyotaK of Flatt Security Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000088.html", "sec:cpe": [ { "#text": "cpe:/a:elecom:wab-i1750-ps", "@product": "WAB-I1750-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/a:elecom:wab-s1167-ps", "@product": "WAB-S1167-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x3000gs2-b_firmware", "@product": "WRC-X3000GS2-B firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x3000gs2-w_firmware", "@product": "WRC-X3000GS2-W firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" }, { "#text": "cpe:/o:elecom:wrc-x3000gs2a-b_firmware", "@product": "WRC-X3000GS2A-B firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2" } ], "sec:cvss": { "@score": "8.8", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0" }, "sec:identifier": "JVNDB-2024-000088", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN24885537/index.html", "@id": "JVN#24885537", "@source": "JVN" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34577", "@id": "CVE-2024-34577", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-39300", "@id": "CVE-2024-39300", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-42412", "@id": "CVE-2024-42412", "@source": "CVE" }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-43689", "@id": "CVE-2024-43689", "@source": "CVE" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-119", "@title": "Buffer Errors(CWE-119)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-Other", "@title": "No Mapping(CWE-Other)" } ], "title": "Multiple vulnerabilities in ELECOM wireless LAN routers and access points" }
cve-2023-40072
Vulnerability from cvelistv5
Published
2023-08-18 09:45
Modified
2024-09-09 06:39
Severity ?
EPSS score ?
Summary
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
References
Impacted products
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T18:24:55.046Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://www.elecom.co.jp/news/security/20231114-01/" }, { "tags": [ "x_transferred" ], "url": "https://www.elecom.co.jp/news/security/20230810-01/" }, { "tags": [ "x_transferred" ], "url": "https://jvn.jp/en/vu/JVNVU91630351/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "WAB-S600-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "all versions" } ] }, { "product": "WAB-S300", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "all versions" } ] }, { "product": "WAB-S1775", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.1.9 and earlier" } ] }, { "product": "WAB-M1775-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.1.21 and earlier" } ] }, { "product": "WAB-S1167", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.0.7 and earlier" } ] }, { "product": "WAB-M2133", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.3.22 and earlier" } ] }, { "product": "WAB-I1750-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.10 and earlier" } ] }, { "product": "WAB-S1167-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.6 and earlier" } ] } ], "descriptions": [ { "lang": "en", "value": "OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request." } ], "problemTypes": [ { "descriptions": [ { "description": "OS command injection", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-09-09T06:39:59.937Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://www.elecom.co.jp/news/security/20231114-01/" }, { "url": "https://www.elecom.co.jp/news/security/20230810-01/" }, { "url": "https://jvn.jp/en/vu/JVNVU91630351/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2023-40072", "datePublished": "2023-08-18T09:45:31.201Z", "dateReserved": "2023-08-09T11:54:59.361Z", "dateUpdated": "2024-09-09T06:39:59.937Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-39300
Vulnerability from cvelistv5
Published
2024-08-30 06:29
Modified
2024-10-21 13:46
Severity ?
EPSS score ?
Summary
Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote attacker may login to the product without authentication and alter the product's settings.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
ELECOM CO.,LTD. | WAB-I1750-PS |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:elecom:wab-i1750-ps_firmware:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "wab-i1750-ps_firmware", "vendor": "elecom", "versions": [ { "lessThanOrEqual": "1.5.10", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-39300", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-08-30T14:32:03.059327Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-21T13:46:23.712Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "WAB-I1750-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.10 and earlier" } ] } ], "descriptions": [ { "lang": "en", "value": "Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote attacker may login to the product without authentication and alter the product\u0027s settings." } ], "problemTypes": [ { "descriptions": [ { "description": "Missing authentication for critical function", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-30T06:29:42.937Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://www.elecom.co.jp/news/security/20240827-01/" }, { "url": "https://jvn.jp/en/jp/JVN24885537/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2024-39300", "datePublished": "2024-08-30T06:29:42.937Z", "dateReserved": "2024-08-16T04:42:10.038Z", "dateUpdated": "2024-10-21T13:46:23.712Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-43689
Vulnerability from cvelistv5
Published
2024-10-21 01:27
Modified
2024-10-21 13:46
Severity ?
EPSS score ?
Summary
Stack-based buffer overflow vulnerability exists in WAB-I1750-PS and WAB-S1167-PS. By processing a specially crafted HTTP request, arbitrary code may be executed.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
ELECOM CO.,LTD. | WAB-I1750-PS | |
ELECOM CO.,LTD. | WAB-S1167-PS |
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:o:elecom:wab-s1167-ps_firmware:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "wab-s1167-ps_firmware", "vendor": "elecom", "versions": [ { "lessThanOrEqual": "1.5.6", "status": "affected", "version": "0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:elecom:wab-i1750-ps_firmware:*:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "wab-i1750-ps_firmware", "vendor": "elecom", "versions": [ { "lessThanOrEqual": "1.5.10", "status": "affected", "version": "0", "versionType": "custom" } ] } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-43689", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-10-21T13:40:28.109591Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-10-21T13:46:18.148Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "WAB-I1750-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.10 and earlier" } ] }, { "product": "WAB-S1167-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.6 and earlier" } ] } ], "descriptions": [ { "lang": "en", "value": "Stack-based buffer overflow vulnerability exists in WAB-I1750-PS and WAB-S1167-PS. By processing a specially crafted HTTP request, arbitrary code may be executed." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-121", "description": "Stack-based buffer overflow", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-21T01:27:15.253Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://www.elecom.co.jp/news/security/20240827-01/" }, { "url": "https://jvn.jp/en/jp/JVN24885537/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2024-43689", "datePublished": "2024-10-21T01:27:15.253Z", "dateReserved": "2024-08-16T04:42:09.104Z", "dateUpdated": "2024-10-21T13:46:18.148Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
cve-2024-42412
Vulnerability from cvelistv5
Published
2024-08-30 06:29
Modified
2024-10-27 15:17
Severity ?
EPSS score ?
Summary
Cross-site scripting vulnerability exists in WAB-I1750-PS and WAB-S1167-PS due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
ELECOM CO.,LTD. | WAB-I1750-PS | |
ELECOM CO.,LTD. | WAB-S1167-PS |
{ "containers": { "adp": [ { "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" } }, { "other": { "content": { "id": "CVE-2024-42412", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-08-30T14:25:15.511783Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-10-27T15:17:17.839Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "WAB-I1750-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.10 and earlier" } ] }, { "product": "WAB-S1167-PS", "vendor": "ELECOM CO.,LTD.", "versions": [ { "status": "affected", "version": "v1.5.6 and earlier" } ] } ], "descriptions": [ { "lang": "en", "value": "Cross-site scripting vulnerability exists in WAB-I1750-PS and WAB-S1167-PS due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user\u0027s web browser." } ], "problemTypes": [ { "descriptions": [ { "description": "Cross-site scripting (XSS)", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2024-08-30T06:29:27.606Z", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert" }, "references": [ { "url": "https://www.elecom.co.jp/news/security/20240827-01/" }, { "url": "https://jvn.jp/en/jp/JVN24885537/" } ] } }, "cveMetadata": { "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2024-42412", "datePublished": "2024-08-30T06:29:27.606Z", "dateReserved": "2024-08-16T04:42:08.243Z", "dateUpdated": "2024-10-27T15:17:17.839Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }