[Japanese]
|
JVNDB-2024-000020
|
Multiple vulnerabilities in ELECOM wireless LAN routers and wireless LAN repeater
|
Multiple wireless LAN routers and wireless LAN repeater provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.
- Cross-site Scripting (CWE-79) - CVE-2024-21798
- Cross-Site Request Forgery (CWE-352) - CVE-2024-23910
CVE-2024-21798
Yamaguchi Kakeru of Fujitsu Limited reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2024-23910
Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
CVSS V3 Severity: Base Metrics 4.8 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
CVSS V2 Severity: Base Metrics 3.5 (Low) [IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: Single Instance
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
The above CVSS base scores have been assigned for CVE-2024-21798
|
CVSS V3 Severity:
Base Metrics
4.3 (Medium) [IPA Score]
-
Attack Vector: Network
-
Attack Complexity: Low
-
Privileges Required: None
-
User Interaction: Required
-
Scope: Unchanged
-
Confidentiality Impact: None
-
Integrity Impact: Low
-
Availability Impact: None
CVSS V2 Severity:Base Metrics
2.6 (Low)
[IPA Score]
-
Access Vector: Network
-
Access Complexity: High
-
Authentication: None
-
Confidentiality Impact: None
-
Integrity Impact: Partial
-
Availability Impact: None
The above CVSS base scores have been assigned for CVE-2024-23910
|
|
ELECOM CO.,LTD.
- WMC-X1800GST-B v1.41 and earlier - CVE-2024-21798
- WMC-X1800GST-B v1.41 and earlier - CVE-2024-23910
- WRC-1167GS2-B v1.67 and earlier - CVE-2024-21798
- WRC-1167GS2-B v1.67 and earlier - CVE-2024-23910
- WRC-1167GS2H-B v1.67 and earlier - CVE-2024-21798
- WRC-1167GS2H-B v1.67 and earlier - CVE-2024-23910
- WRC-2533GS2-B v1.62 and earlier - CVE-2024-21798
- WRC-2533GS2-B v1.62 and earlier - CVE-2024-23910
- WRC-2533GS2-W v1.62 and earlier - CVE-2024-21798
- WRC-2533GS2-W v1.62 and earlier - CVE-2024-23910
- WRC-2533GS2V-B v1.62 and earlier - CVE-2024-21798
- WRC-2533GS2V-B v1.62 and earlier - CVE-2024-23910
- WRC-G01-W v1.24 and earlier - CVE-2024-21798
- WRC-G01-W v1.24 and earlier - CVE-2024-23910
- WRC-X3200GST3-B v1.25 and earlier - CVE-2024-21798
- WRC-X3200GST3-B v1.25 and earlier - CVE-2024-23910
- WSC-X1800GS-B v1.41 and earlier - CVE-2024-23910
|
WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B" provided by ELECOM CO.,LTD.
|
- Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser - CVE-2024-21798
- If an administrative user logs in to the affected product and views a malicious page, it may trick the user to perform unintended operations to the affected product - CVE-2024-23910
|
[Update the firmware]
Update the firmware to the latest version according to the information provided by the developer.
|
ELECOM CO.,LTD.
|
- Cross-Site Request Forgery(CWE-352) [IPA Evaluation]
- Cross-site Scripting(CWE-79) [IPA Evaluation]
|
- CVE-2024-21798
- CVE-2024-23910
|
- JVN : JVN#44166658
|
- [2024/02/20]
Web page was published
- [2024/03/26]
Affected Products : Products were added
- [2024/05/28]
Title was modified
Overview was modified
Affected Products : Products were added
|