CVE-2024-34021

2024-08-0101:15:56

jpcert

github.com

elecom

wireless lan

file upload

vulnerability

administrative privilege

os command execution

AI Score

7.2

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:elecom:wrc-2533gs2v-b_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "elecom",
    "product": "wrc-2533gs2v-b_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.68"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "elecom",
    "product": "wrc-2533gs2-b_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.68"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "elecom",
    "product": "wrc-2533gs2-w_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.68"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "elecom",
    "product": "wrc-2533gst2_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.30"
      }
    ],
    "defaultStatus": "unknown"
  }
]