PT-2023-26025 · Elecom+1 · Elecom Wrc-600Ghbk-A+7

Chuya Hayakawa · Published 2023-07-13 · Updated 2023-08-18 · CVE-2023-37567

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ELECOM WRC-1167GHBK3-A versions 1.24 and earlier ELECOM WRC-F1167ACF2 all versions ELECOM WRC-600GHBK-A all versions ELECOM WRC-733FEBK2-A all versions ELECOM WRC-1467GHBK-A all versions ELECOM WRC-1900GHBK-A all versions ELECOM LAN-W301NR all versions LOGITEC wireless LAN routers (affected versions not specified)

Description A command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page.

Recommendations For ELECOM WRC-1167GHBK3-A versions 1.24 and earlier, update to a version later than 1.24. For ELECOM WRC-F1167ACF2, WRC-600GHBK-A, WRC-733FEBK2-A, WRC-1467GHBK-A, WRC-1900GHBK-A, and LAN-W301NR, restrict access to the web management page until a patch is available. For LOGITEC wireless LAN routers, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-37567

Affected Products

Elecom Lan-W301Nr

Elecom Wrc-1167Ghbk3-A

Elecom Wrc-1467Ghbk-A

Elecom Wrc-1900Ghbk-A

Elecom Wrc-600Ghbk-A

Elecom Wrc-733Febk2-A

Elecom Wrc-F1167Acf2

Logitec Wireless Lan Routers

References · 7

• https://elecom.co.jp/news/security/20230711-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37567 · Security Note
• https://t.me/cibsecurity/66630 · Telegram Post
• https://t.me/cvenotify/56834 · Telegram Post
• https://jvn.jp/en/vu/JVNVU91850798 · Note
• https://elecom.co.jp/news/security/20230810-01 · Note