PT-2021-14305 · Elecom · Elecom Wrc-2533Gst2+7

Chuya Hayakawa + 2 · Published 2021-12-01 · Updated 2021-12-02 · CVE-2021-20862

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 firmware versions 1.25 and prior ELECOM WRC-1167GST2A firmware versions 1.25 and prior ELECOM WRC-1167GST2H firmware versions 1.25 and prior ELECOM WRC-2533GS2-B firmware versions 1.52 and prior ELECOM WRC-2533GS2-W firmware versions 1.52 and prior ELECOM WRC-1750GS firmware versions 1.03 and prior ELECOM WRC-1750GSV firmware versions 2.11 and prior ELECOM WRC-1900GST firmware versions 1.03 and prior ELECOM WRC-2533GST firmware versions 1.03 and prior ELECOM WRC-2533GSTA firmware versions 1.03 and prior ELECOM WRC-2533GST2 firmware versions 1.25 and prior ELECOM WRC-2533GST2SP firmware versions 1.25 and prior ELECOM WRC-2533GST2-G firmware versions 1.25 and prior ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior

Description: The issue is related to improper access control in ELECOM routers, allowing a network-adjacent unauthenticated attacker to bypass access restrictions. This enables the attacker to obtain anti-CSRF tokens and change the product's settings via unspecified vectors.

Recommendations: For ELECOM WRC-1167GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2A firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2H firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GS2-B firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-2533GS2-W firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-1750GS firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-1750GSV firmware versions 2.11 and prior, update to a version later than 2.11. For ELECOM WRC-1900GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GSTA firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2SP firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2-G firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25.

Fix

Related Identifiers

CVE-2021-20862

Affected Products

Elecom Edwrc-2533Gst2

Elecom Wrc-1167Gst2

Elecom Wrc-1750Gs

Elecom Wrc-1900Gst

Elecom Wrc-2533Gs2-B

Elecom Wrc-2533Gs2-W

Elecom Wrc-2533Gst

Elecom Wrc-2533Gst2

References · 5

• https://osv.dev/vulnerability/CVE-2021-20862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20862 · Security Note
• https://elecom.co.jp/news/security/20211130-01 · Vendor Advisory
• https://jvn.jp/en/vu/JVNVU94527926/index.html · Note
• https://t.me/cibsecurity/33172 · Telegram Post