Cross-Site Scripting Vulnerability in Elecom WRH-300WH-H and WTC-300HWH Products
CVE-2023-37560

6.1MEDIUM

Key Information:

Vendor
Elecom Co.,ltd.
Status
Wrh-300wh-h
Wtc-300hwh
Vendor
CVE Published:
13 July 2023

Summary

A cross-site scripting vulnerability exists in Elecom's WRH-300WH-H v2.12 and earlier and WTC-300HWH v1.09 and earlier devices. This flaw enables remote unauthenticated attackers to inject arbitrary scripts via crafted requests, potentially compromising the security of affected users and systems. It is crucial for users of these devices to apply the necessary security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

WRH-300WH-H v2.12 and earlier

WTC-300HWH v1.09 and earlier

References

https://www.elecom.co.jp/news/security/20230711-01/
https://jvn.jp/en/jp/JVN05223215/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.