Cross-Site Request Forgery in ELECOM LAN Routers
CVE-2021-20860

8.8HIGH

Key Information:

Vendor
Elecom Co.,ltd.
Status
Elecom Lan Routers
Vendor
CVE Published:
1 December 2021

Summary

A cross-site request forgery (CSRF) vulnerability exists in various models of ELECOM LAN routers, allowing an authenticated remote attacker to execute unauthorized actions on behalf of an administrative user. This can lead to the hijacking of administrative sessions via specially crafted pages, posing significant risks to network security and management. Affected users should ensure their routers are updated to the latest firmware to mitigate these vulnerabilities.

Affected Version(s)

ELECOM LAN routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior

References

https://www.elecom.co.jp/news/security/20211130-01/
x_refsource_MISC
https://jvn.jp/en/jp/JVN88993473/index.html
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.