Lucene search

JpcertCVE-2024-22372

HistoryJan 24, 2024 - 5:15 a.m.

CVE-2024-22372

2024-01-2405:15:14

CWE-78

jpcert

web.nvd.nist.gov

cve-2024-22372

os command injection

elecom

wireless lan routers

network-adjacent attacker

vulnerability

CVSS3

6.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.6%

JSON

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product.

Affected configurations

Nvd

Vulners

Node

elecomwrc-x1800gs-b_firmwareRange<1.18

AND

elecomwrc-x1800gs-bMatch-

Node

elecomwrc-x1800gsh-b_firmwareRange<1.18

AND

elecomwrc-x1800gsh-bMatch-

Node

elecomwrc-x1800gsa-b_firmwareRange<1.18

AND

elecomwrc-x1800gsa-bMatch-

Node

elecomwrc-x6000xs-g_firmwareMatch1.09

AND

elecomwrc-x6000xs-gMatch-

Node

elecomwrc-x6000xst-g_firmwareRange<1.14

AND

elecomwrc-x6000xst-gMatch-

VendorProductVersionCPE
elecomwrc-x1800gs-b_firmware*cpe:2.3:o:elecom:wrc-x1800gs-b_firmware:*:*:*:*:*:*:*:*
elecomwrc-x1800gs-b-cpe:2.3:h:elecom:wrc-x1800gs-b:-:*:*:*:*:*:*:*
elecomwrc-x1800gsh-b_firmware*cpe:2.3:o:elecom:wrc-x1800gsh-b_firmware:*:*:*:*:*:*:*:*
elecomwrc-x1800gsh-b-cpe:2.3:h:elecom:wrc-x1800gsh-b:-:*:*:*:*:*:*:*
elecomwrc-x1800gsa-b_firmware*cpe:2.3:o:elecom:wrc-x1800gsa-b_firmware:*:*:*:*:*:*:*:*
elecomwrc-x1800gsa-b-cpe:2.3:h:elecom:wrc-x1800gsa-b:-:*:*:*:*:*:*:*
elecomwrc-x6000xs-g_firmware1.09cpe:2.3:o:elecom:wrc-x6000xs-g_firmware:1.09:*:*:*:*:*:*:*
elecomwrc-x6000xs-g-cpe:2.3:h:elecom:wrc-x6000xs-g:-:*:*:*:*:*:*:*
elecomwrc-x6000xst-g_firmware*cpe:2.3:o:elecom:wrc-x6000xst-g_firmware:*:*:*:*:*:*:*:*
elecomwrc-x6000xst-g-cpe:2.3:h:elecom:wrc-x6000xst-g:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
elecom	wrc-x1800gs-b_firmware	*	cpe:2.3:o:elecom:wrc-x1800gs-b_firmware::::::::
elecom	wrc-x1800gs-b	-	cpe:2.3:h:elecom:wrc-x1800gs-b:-:::::::*
elecom	wrc-x1800gsh-b_firmware	*	cpe:2.3:o:elecom:wrc-x1800gsh-b_firmware::::::::
elecom	wrc-x1800gsh-b	-	cpe:2.3:h:elecom:wrc-x1800gsh-b:-:::::::*
elecom	wrc-x1800gsa-b_firmware	*	cpe:2.3:o:elecom:wrc-x1800gsa-b_firmware::::::::
elecom	wrc-x1800gsa-b	-	cpe:2.3:h:elecom:wrc-x1800gsa-b:-:::::::*
elecom	wrc-x6000xs-g_firmware	1.09	cpe:2.3:o:elecom:wrc-x6000xs-g_firmware:1.09:::::::*
elecom	wrc-x6000xs-g	-	cpe:2.3:h:elecom:wrc-x6000xs-g:-:::::::*
elecom	wrc-x6000xst-g_firmware	*	cpe:2.3:o:elecom:wrc-x6000xst-g_firmware::::::::
elecom	wrc-x6000xst-g	-	cpe:2.3:h:elecom:wrc-x6000xst-g:-:::::::*

CNA Affected

[
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X1800GS-B",
    "versions": [
      {
        "version": "v1.17 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X1800GSA-B",
    "versions": [
      {
        "version": "v1.17 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X1800GSH-B",
    "versions": [
      {
        "version": "v1.17 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X6000XS-G",
    "versions": [
      {
        "version": "v1.09",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X6000XST-G",
    "versions": [
      {
        "version": "v1.12 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X1500GS-B",
    "versions": [
      {
        "version": "v1.11 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X1500GSA-B",
    "versions": [
      {
        "version": "v1.11 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X3000GS2-B",
    "versions": [
      {
        "version": "v1.08 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X3000GS2-W",
    "versions": [
      {
        "version": "v1.08 and earlier",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "ELECOM CO.,LTD.",
    "product": "WRC-X3000GS2A-B",
    "versions": [
      {
        "version": "v1.08 and earlier",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU90908488/

www.elecom.co.jp/news/security/20240123-01/

CVSS3

6.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.6%

JSON

Related for CVE-2024-22372