CVE-2021-20650

2021-02-1206:15:51

jpcert

www.cve.org

cross-site request forgery

elecom ncc-ewf100rmwh2

arbitrary request execution

device settings alteration

telnet daemon

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started.

CNA Affected

[
  {
    "product": "NCC-EWF100RMWH2",
    "vendor": "ELECOM CO.,LTD.",
    "versions": [
      {
        "status": "affected",
        "version": "NCC-EWF100RMWH2"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN47580234/index.html

www.elecom.co.jp/news/security/20210126-01/