PT-2021-14307 · Elecom · Elecom Wrc-2533Gst2+7

Chuya Hayakawa + 2 · Published 2021-12-01 · Updated 2022-07-12 · CVE-2021-20864

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 firmware versions 1.25 and prior ELECOM WRC-1167GST2A firmware versions 1.25 and prior ELECOM WRC-1167GST2H firmware versions 1.25 and prior ELECOM WRC-2533GS2-B firmware versions 1.52 and prior ELECOM WRC-2533GS2-W firmware versions 1.52 and prior ELECOM WRC-1750GS firmware versions 1.03 and prior ELECOM WRC-1750GSV firmware versions 2.11 and prior ELECOM WRC-1900GST firmware versions 1.03 and prior ELECOM WRC-2533GST firmware versions 1.03 and prior ELECOM WRC-2533GSTA firmware versions 1.03 and prior ELECOM WRC-2533GST2 firmware versions 1.25 and prior ELECOM WRC-2533GST2SP firmware versions 1.25 and prior ELECOM WRC-2533GST2-G firmware versions 1.25 and prior ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior

Description: The issue is related to improper access control in ELECOM routers, allowing a network-adjacent unauthenticated attacker to bypass access restrictions. This enables the attacker to start the telnet service and execute arbitrary OS commands via unspecified vectors.

Recommendations: For ELECOM WRC-1167GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2A firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2H firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GS2-B firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-2533GS2-W firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-1750GS firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-1750GSV firmware versions 2.11 and prior, update to a version later than 2.11. For ELECOM WRC-1900GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GSTA firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2SP firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2-G firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25.

Fix

Related Identifiers

CVE-2021-20864

Affected Products

Elecom Edwrc-2533Gst2

Elecom Wrc-1167Gst2

Elecom Wrc-1750Gs

Elecom Wrc-1900Gst

Elecom Wrc-2533Gs2-B

Elecom Wrc-2533Gs2-W

Elecom Wrc-2533Gst

Elecom Wrc-2533Gst2

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-20864 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20864 · Vendor Advisory
• https://elecom.co.jp/news/security/20211130-01 · Vendor Advisory
• https://t.me/cibsecurity/33156 · Telegram Post
• https://jvn.jp/en/vu/JVNVU94527926/index.html · Note