Stored Cross-Site Scripting Vulnerability in Elecom WRC-1167GHBK2-S
CVE-2025-43877

4.8MEDIUM

Key Information:

Vendor

Elecom Co.,ltd.

Status
Wrc-1167ghbk2-s
Vendor
CVE Published:
24 June 2025

What is CVE-2025-43877?

The Elecom WRC-1167GHBK2-S router is susceptible to a stored cross-site scripting vulnerability within its WebGUI. This flaw allows an attacker to inject arbitrary scripts that execute in the web browser of a user accessing the WebGUI. If successfully exploited, this could lead to unauthorized actions being performed on behalf of the victim, potentially exposing sensitive information or compromising user security.

Affected Version(s)

WRC-1167GHBK2-S all versions

References

https://www.elecom.co.jp/news/security/20250624-02/
https://jvn.jp/en/jp/JVN39435597/

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-43877 : Stored Cross-Site Scripting Vulnerability in Elecom WRC-1167GHBK2-S