Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc.

Related CPE's

o

elecom

wrc-2533gs2-b_firmware

Vulnerable

h

elecom

wrc-2533gs2-b

-

o

elecom

wrc-2533gs2-w_firmware

Vulnerable

h

elecom

wrc-2533gs2-w

-

o

elecom

wrc-2533gs2v-b_firmware

Vulnerable

h

elecom

wrc-2533gs2v-b

-

o

elecom

wrc-x6000xs-g_firmware

Vulnerable

h

elecom

wrc-x6000xs-g

-

o

elecom

wrc-x1500gs-b_firmware

Vulnerable

h

elecom

wrc-x1500gs-b

o

elecom

wrc-x1500gsa-b_firmware

Vulnerable

h

elecom

wrc-x1500gsa-b

References

https://jvn.jp/en/jp/JVN06672778/

Third Party Advisory

https://www.elecom.co.jp/news/security/20240730-01/

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-352

[email protected]

Secondary
CWE-352

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 · High

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2024-08-01T02:15:02.023

3 months ago

Last modified

2024-09-26T05:15:11.973

1 month ago