PT-2021-14306 · Elecom · Elecom Wrc-2533Gst2+7

Chuya Hayakawa + 2 · Published 2021-12-01 · Updated 2021-12-02 · CVE-2021-20863

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 versions 1.25 and prior ELECOM WRC-1167GST2A versions 1.25 and prior ELECOM WRC-1167GST2H versions 1.25 and prior ELECOM WRC-2533GS2-B versions 1.52 and prior ELECOM WRC-2533GS2-W versions 1.52 and prior ELECOM WRC-1750GS versions 1.03 and prior ELECOM WRC-1750GSV versions 2.11 and prior ELECOM WRC-1900GST versions 1.03 and prior ELECOM WRC-2533GST versions 1.03 and prior ELECOM WRC-2533GSTA versions 1.03 and prior ELECOM WRC-2533GST2 versions 1.25 and prior ELECOM WRC-2533GST2SP versions 1.25 and prior ELECOM WRC-2533GST2-G versions 1.25 and prior ELECOM EDWRC-2533GST2 versions 1.25 and prior

Description: The issue allows a network-adjacent authenticated attacker to execute an arbitrary OS command with the root privilege via unspecified vectors.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-20863

Affected Products

Elecom Edwrc-2533Gst2

Elecom Wrc-1167Gst2

Elecom Wrc-1750Gs

Elecom Wrc-1900Gst

Elecom Wrc-2533Gs2-B

Elecom Wrc-2533Gs2-W

Elecom Wrc-2533Gst

Elecom Wrc-2533Gst2

References · 5

• https://osv.dev/vulnerability/CVE-2021-20863 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20863 · Security Note
• https://elecom.co.jp/news/security/20211130-01 · Vendor Advisory
• https://t.me/cibsecurity/33164 · Telegram Post
• https://jvn.jp/en/vu/JVNVU94527926/index.html · Note