Command Injection in ELECOM Wireless LAN Routers
CVE-2023-37568

8HIGH

Key Information:

Vendor
Elecom Co.,ltd.
Status
Wrc-1167ghbk-s
Wrc-1167gebk-s
Vendor
CVE Published:
13 July 2023

Summary

ELECOM wireless LAN routers, specifically the WRC-1167GHBK-S and WRC-1167GEBK-S models, have a critical command injection vulnerability that allows unauthorized network-adjacent attackers to execute arbitrary commands. This vulnerability arises when attackers send specially crafted requests to the web management interface, potentially compromising the security of the device and the network it is connected to. Users of affected versions are urged to review their device configuration and consider implementing security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

WRC-1167GEBK-S v1.03 and earlier

WRC-1167GHBK-S v1.03 and earlier

References

https://www.elecom.co.jp/news/security/20230711-01/
https://jvn.jp/en/vu/JVNVU91850798/

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.