OS Command Injection Vulnerability in ELECOM Wireless LAN Routers
CVE-2024-22372

6.8MEDIUM

Key Information:

Vendor

Elecom Co.,ltd.

Status
Wrc-x1500gs-b
Wrc-x1500gsa-b
Wrc-x1800gs-b
Wrc-x1800gsa-b
Vendor
CVE Published:
24 January 2024

What is CVE-2024-22372?

An OS command injection vulnerability exists in select ELECOM wireless LAN routers, permitting an attacker with administrative privileges to execute arbitrary operating system commands. This exploit can be initiated by submitting a specially crafted request, posing an increased risk to network integrity and security.

Affected Version(s)

WRC-X1500GS-B v1.11 and earlier

WRC-X1500GSA-B v1.11 and earlier

WRC-X1800GS-B v1.17 and earlier

References

https://www.elecom.co.jp/news/security/20240123-01/
https://jvn.jp/en/vu/JVNVU90908488/

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.