Cross-Site Scripting Vulnerability in ELECOM LAN Router Firmware
CVE-2021-20857

5.4MEDIUM

Key Information:

Vendor
Elecom Co.,ltd.
Status
Elecom Lan Router
Vendor
CVE Published:
1 December 2021

Summary

A cross-site scripting vulnerability exists in the firmware of the ELECOM LAN router WRC-2533GHBK-I, specifically in versions prior to v1.20. This flaw allows a remote authenticated attacker to inject arbitrary scripts through unspecified methods. Exploiting this vulnerability could lead to unauthorized access and manipulation of web content in users' browsers, posing serious security risks to affected devices.

Affected Version(s)

ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior

References

https://www.elecom.co.jp/news/security/20211130-01/
x_refsource_MISC
https://jvn.jp/en/jp/JVN88993473/index.html
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.