OS Command Injection Vulnerability in ELECOM Wireless LAN Routers
CVE-2024-25579

6.8MEDIUM

Key Information:

Vendor
Elecom Co.,ltd.
Status
Wrc-1167gs2-b
Wrc-1167gs2h-b
Wrc-1167gst2
Wrc-2533gs2-b
Vendor
CVE Published:
28 February 2024

Summary

An OS command injection vulnerability exists in ELECOM wireless LAN routers that could allow a network-adjacent attacker with administrative privileges to execute arbitrary operating system commands. This is done by sending a specially crafted request to the affected product. Notably, the WMC-X1800GST-B model is also included in the e-Mesh Starter Kit WMC-2LX-B, making it critical for users to review and secure their configurations to mitigate potential risks.

Affected Version(s)

WMC-X1800GST-B v1.41 and earlier

WRC-1167GS2-B v1.67 and earlier

WRC-1167GS2H-B v1.67 and earlier

References

https://www.elecom.co.jp/news/security/20240220-01/
https://jvn.jp/en/vu/JVNVU99444194/

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.