PT-2024-21016 · Elecom · Wrc-G01-W+3

Chuya Hayakawa

·

Published

2024-02-28

·

Updated

2024-11-26

·

CVE-2024-25579

CVSS v3.1

6.8

Medium

VectorAV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ELECOM wireless LAN routers versions prior to the following: WRC-1167GS2-B version 1.67 WRC-1167GS2H-B version 1.67 WRC-2533GS2-B version 1.62 WRC-2533GS2-W version 1.62 WRC-2533GS2V-B version 1.62 WRC-X3200GST3-B version 1.25 WRC-G01-W version 1.24
Description The issue allows a network-adjacent attacker with administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product.
Recommendations For WRC-1167GS2-B version 1.67 and earlier, update to a version later than 1.67. For WRC-1167GS2H-B version 1.67 and earlier, update to a version later than 1.67. For WRC-2533GS2-B version 1.62 and earlier, update to a version later than 1.62. For WRC-2533GS2-W version 1.62 and earlier, update to a version later than 1.62. For WRC-2533GS2V-B version 1.62 and earlier, update to a version later than 1.62. For WRC-X3200GST3-B version 1.25 and earlier, update to a version later than 1.25. For WRC-G01-W version 1.24 and earlier, update to a version later than 1.24.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-25579

Affected Products

Wrc-1167Gs2-B
Wrc-2533Gs2-B
Wrc-G01-W
Wrc-X3200Gst3-B