Search a vulnerability

cve-2024-25579

Vulnerability from cvelistv5

Published

2024-02-28 23:08

Modified

2024-09-09 06:32

Severity ?

6.8 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".

References

▼	URL	Tags
	https://www.elecom.co.jp/news/security/20240220-01/
	https://jvn.jp/en/vu/JVNVU99444194/

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WRC-1167GS2-B
	ELECOM CO.,LTD.	WRC-1167GS2H-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-2533GST2
	ELECOM CO.,LTD.	WRC-X3200GST3-B
	ELECOM CO.,LTD.	WRC-G01-W
	ELECOM CO.,LTD.	WMC-X1800GST-B

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:44:09.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.elecom.co.jp/news/security/20240220-01/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU99444194/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-1167gs2-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-1167gs2-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.67",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-1167gs2h-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-1167gs2h-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.67",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-w_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2v-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2v-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-x3200gst3-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-x3200gst3-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.25",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-g01-w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-g01-w_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.24",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wmc-x1800gst-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wmc-x1800gst-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.41",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-25579",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-01T16:04:56.890317Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T15:17:27.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-1167GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-1167GS2H-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2V-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GST2",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.30 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3200GST3-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.25 and earlier"
            }
          ]
        },
        {
          "product": "WRC-G01-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.24 and earlier"
            }
          ]
        },
        {
          "product": "WMC-X1800GST-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.41 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit \"WMC-2LX-B\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS command injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-09T06:32:25.956Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20240220-01/"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU99444194/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-25579",
    "datePublished": "2024-02-28T23:08:49.598Z",
    "dateReserved": "2024-02-15T01:25:08.855Z",
    "dateUpdated": "2024-09-09T06:32:25.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-34021

Vulnerability from cvelistv5

Published

2024-08-01 01:15

Modified

2024-09-09 20:56

Severity ?

6.8 (Medium) - CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution.

References

▼	URL	Tags
	https://www.elecom.co.jp/news/security/20240730-01/
	https://jvn.jp/en/jp/JVN06672778/

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GST2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2v-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2v-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.68",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.68",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-w_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.68",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gst2_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThanOrEqual": "1.30",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-34021",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-01T13:31:32.438360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-434",
                "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T20:56:59.455Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-2533GS2V-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GST2",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.30 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-09T06:22:05.653Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20240730-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN06672778/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-34021",
    "datePublished": "2024-08-01T01:15:56.174Z",
    "dateReserved": "2024-07-26T08:52:16.452Z",
    "dateUpdated": "2024-09-09T20:56:59.455Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-23910

Vulnerability from cvelistv5

Published

2024-02-28 23:07

Modified

2024-09-09 06:36

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B".

References

▼	URL	Tags
	https://www.elecom.co.jp/news/security/20240220-01/
	https://jvn.jp/en/jp/JVN44166658/

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WRC-1167GS2-B
	ELECOM CO.,LTD.	WRC-1167GS2H-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-2533GST2
	ELECOM CO.,LTD.	WRC-X3200GST3-B
	ELECOM CO.,LTD.	WRC-G01-W
	ELECOM CO.,LTD.	WMC-X1800GST-B
	ELECOM CO.,LTD.	WSC-X1800GS-B

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:elecom:wrc-1167gs2-b:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-1167gs2-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.67",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:elecom:wrc-1167gs2h-b:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-1167gs2h-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.67",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:elecom:wrc-2533gs2-b:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:elecom:wrc-2533gs2-w:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2-w",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:elecom:wrc-2533gs2v-b:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-2533gs2v-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.62",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-x3200gst3-b_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-x3200gst3-b_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.25",
                "status": "affected",
                "version": "elecom",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:elecom:wrc-g01-w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wrc-g01-w_firmware",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.24",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:elecom:wmc-x1800gst-b:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wmc-x1800gst-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.41",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:elecom:wsc-x1800gs-b:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wsc-x1800gs-b",
            "vendor": "elecom",
            "versions": [
              {
                "lessThan": "v1.41",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-23910",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-05T20:40:19.820700Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T16:18:46.820Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:13:08.529Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.elecom.co.jp/news/security/20240220-01/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN44166658/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-1167GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-1167GS2H-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2V-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GST2",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.30 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3200GST3-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.25 and earlier"
            }
          ]
        },
        {
          "product": "WRC-G01-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.24 and earlier"
            }
          ]
        },
        {
          "product": "WMC-X1800GST-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.41 and earlier"
            }
          ]
        },
        {
          "product": "WSC-X1800GS-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.41 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit \"WMC-2LX-B\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-09T06:36:00.982Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20240220-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN44166658/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-23910",
    "datePublished": "2024-02-28T23:07:02.324Z",
    "dateReserved": "2024-02-15T01:25:06.163Z",
    "dateUpdated": "2024-09-09T06:36:00.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-21798

Vulnerability from cvelistv5

Published

2024-02-28 23:03

Modified

2024-11-13 18:08

Severity ?

Summary

ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".

References

▼	URL	Tags
	https://www.elecom.co.jp/news/security/20240220-01/
	https://jvn.jp/en/jp/JVN44166658/

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WRC-1167GS2-B
	ELECOM CO.,LTD.	WRC-1167GS2H-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-2533GST2
	ELECOM CO.,LTD.	WRC-X3200GST3-B
	ELECOM CO.,LTD.	WRC-G01-W
	ELECOM CO.,LTD.	WMC-X1800GST-B

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-14T19:43:48.346433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T18:08:56.473Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:36.306Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.elecom.co.jp/news/security/20240220-01/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN44166658/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WRC-1167GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-1167GS2H-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.67 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GS2V-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.62 and earlier"
            }
          ]
        },
        {
          "product": "WRC-2533GST2",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.30 and earlier"
            }
          ]
        },
        {
          "product": "WRC-X3200GST3-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.25 and earlier"
            }
          ]
        },
        {
          "product": "WRC-G01-W",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.24 and earlier"
            }
          ]
        },
        {
          "product": "WMC-X1800GST-B",
          "vendor": "ELECOM CO.,LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "v1.41 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit \"WMC-2LX-B\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-09T06:34:38.752Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.elecom.co.jp/news/security/20240220-01/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN44166658/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2024-21798",
    "datePublished": "2024-02-28T23:03:39.483Z",
    "dateReserved": "2024-02-15T01:25:08.021Z",
    "dateUpdated": "2024-11-13T18:08:56.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

jvndb-2024-002831

Vulnerability from jvndb

Published

2024-02-22 08:15

Modified

2024-08-28 17:09

Severity ?

6.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

ELECOM wireless LAN routers vulnerable to OS command injection

Details

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain an OS command injection vulnerability. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer.

References

▼	Type	URL
	JVN	https://jvn.jp/en/vu/JVNVU99444194/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-25579
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WMC-X1800GST-B
	ELECOM CO.,LTD.	WRC-1167GS2-B
	ELECOM CO.,LTD.	WRC-1167GS2H-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-2533GST2 firmware
	ELECOM CO.,LTD.	WRC-G01-W
	ELECOM CO.,LTD.	WRC-X3200GST3-B

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-002831.html",
  "dc:date": "2024-08-28T17:09+09:00",
  "dcterms:issued": "2024-02-22T08:15+09:00",
  "dcterms:modified": "2024-08-28T17:09+09:00",
  "description": "Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain an OS command injection vulnerability.\r\n\r\nChuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-002831.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:elecom:wmc-x1800gst-b",
      "@product": "WMC-X1800GST-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2-b_firmware",
      "@product": "WRC-1167GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2h-b_firmware",
      "@product": "WRC-1167GS2H-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-b_firmware",
      "@product": "WRC-2533GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-w_firmware",
      "@product": "WRC-2533GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2v-b_firmware",
      "@product": "WRC-2533GS2V-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gst2_firmware",
      "@product": "WRC-2533GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-g01-w",
      "@product": "WRC-G01-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3200gst3-b",
      "@product": "WRC-X3200GST3-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "5.2",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
      "@version": "2.0"
    },
    {
      "@score": "6.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2024-002831",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU99444194/index.html",
      "@id": "JVNVU#99444194",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-25579",
      "@id": "CVE-2024-25579",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "ELECOM wireless LAN routers vulnerable to OS command injection"
}

jvndb-2024-000020

Vulnerability from jvndb

Published

2024-02-20 14:14

Modified

2024-03-26 14:10

Severity ?

4.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Summary

Multiple vulnerabilities in ELECOM wireless LAN routers and wireless LAN repeater

Details

Multiple wireless LAN routers and wireless LAN repeater provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. <ul><li>Cross-site Scripting (CWE-79) - CVE-2024-21798</li> <li>Cross-Site Request Forgery (CWE-352) - CVE-2024-23910</li></ul> CVE-2024-21798 Yamaguchi Kakeru of Fujitsu Limited reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2024-23910 Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN44166658/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-21798
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-23910
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WMC-X1800GST-B
	ELECOM CO.,LTD.	WRC-1167GS2-B
	ELECOM CO.,LTD.	WRC-1167GS2H-B
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-G01-W
	ELECOM CO.,LTD.	WRC-X3200GST3-B
	ELECOM CO.,LTD.	WSC-X1800GS-B

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000020.html",
  "dc:date": "2024-03-26T14:10+09:00",
  "dcterms:issued": "2024-02-20T14:14+09:00",
  "dcterms:modified": "2024-03-26T14:10+09:00",
  "description": "Multiple wireless LAN routers and wireless LAN repeater provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\u003cli\u003eCross-site Scripting (CWE-79) - CVE-2024-21798\u003c/li\u003e\r\n\u003cli\u003eCross-Site Request Forgery (CWE-352) - CVE-2024-23910\u003c/li\u003e\u003c/ul\u003e\r\n\r\nCVE-2024-21798\r\nYamaguchi Kakeru of Fujitsu Limited reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-23910\r\nSatoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000020.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:elecom:wmc-x1800gst-b",
      "@product": "WMC-X1800GST-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2-b_firmware",
      "@product": "WRC-1167GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2h-b_firmware",
      "@product": "WRC-1167GS2H-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-b_firmware",
      "@product": "WRC-2533GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-w_firmware",
      "@product": "WRC-2533GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2v-b_firmware",
      "@product": "WRC-2533GS2V-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-g01-w",
      "@product": "WRC-G01-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3200gst3-b",
      "@product": "WRC-X3200GST3-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wsc-x1800gs-b",
      "@product": "WSC-X1800GS-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "3.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.8",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2024-000020",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN44166658/index.html",
      "@id": "JVN#44166658",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-21798",
      "@id": "CVE-2024-21798",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-23910",
      "@id": "CVE-2024-23910",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in ELECOM wireless LAN routers and wireless LAN repeater"
}

jvndb-2024-000078

Vulnerability from jvndb

Published

2024-07-30 15:34

Modified

2024-09-24 17:04

Severity ?

6.8 (Medium) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in ELECOM wireless LAN routers

Details

Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. Unrestricted Upload of File with Dangerous Type (CWE-434) CVE-2024-34021 OS Command Injection (CWE-78) CVE-2024-39607 Cross-Site Request Forgery (CWE-352) CVE-2024-40883 CVE-2024-34021 Toyama Taku, and Daichi Arai of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2024-39607, CVE-2024-40883 Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN06672778/
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-34021
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-39607
	CVE	https://www.cve.org/CVERecord?id=CVE-2024-40883
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	ELECOM CO.,LTD.	WRC-2533GS2-B
	ELECOM CO.,LTD.	WRC-2533GS2-W
	ELECOM CO.,LTD.	WRC-2533GS2V-B
	ELECOM CO.,LTD.	WRC-X1500GS-B
	ELECOM CO.,LTD.	WRC-X1500GSA-B
	ELECOM CO.,LTD.	WRC-X3000GS2-B firmware
	ELECOM CO.,LTD.	WRC-X3000GS2-W firmware
	ELECOM CO.,LTD.	WRC-X3000GS2A-B firmware
	ELECOM CO.,LTD.	WRC-X6000XS-G
	ELECOM CO.,LTD.	WRC-X6000XST-G

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000078.html",
  "dc:date": "2024-09-24T17:04+09:00",
  "dcterms:issued": "2024-07-30T15:34+09:00",
  "dcterms:modified": "2024-09-24T17:04+09:00",
  "description": "Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\nUnrestricted Upload of File with Dangerous Type (CWE-434)\r\nCVE-2024-34021\r\nOS Command Injection (CWE-78)\r\nCVE-2024-39607\r\nCross-Site Request Forgery (CWE-352)\r\nCVE-2024-40883\r\n\r\nCVE-2024-34021\r\nToyama Taku, and Daichi Arai of NEC Corporation reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-39607, CVE-2024-40883\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000078.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-b_firmware",
      "@product": "WRC-2533GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-w_firmware",
      "@product": "WRC-2533GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2v-b_firmware",
      "@product": "WRC-2533GS2V-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1500GS-B",
      "@product": "WRC-X1500GS-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x1500GSA-B",
      "@product": "WRC-X1500GSA-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-b_firmware",
      "@product": "WRC-X3000GS2-B firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2-w_firmware",
      "@product": "WRC-X3000GS2-W firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x3000gs2a-b_firmware",
      "@product": "WRC-X3000GS2A-B firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xs-g_firmware",
      "@product": "WRC-X6000XS-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-x6000xst-g_firmware",
      "@product": "WRC-X6000XST-G",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "6.8",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2024-000078",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN06672778/",
      "@id": "JVN#06672778",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34021",
      "@id": "CVE-2024-34021",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-39607",
      "@id": "CVE-2024-39607",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2024-40883",
      "@id": "CVE-2024-40883",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Multiple vulnerabilities in ELECOM wireless LAN routers"
}

All the vulnerabilites related to ELECOM CO.,LTD. - WRC-2533GS2V-B

cve-2024-25579

Vulnerability from cvelistv5

cve-2024-34021

Vulnerability from cvelistv5

cve-2024-23910

Vulnerability from cvelistv5

cve-2024-21798

Vulnerability from cvelistv5

jvndb-2024-002831

Vulnerability from jvndb

jvndb-2024-000020

Vulnerability from jvndb

jvndb-2024-000078

Vulnerability from jvndb