OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-600GHBK-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-F1167ACF2 all versions, WRC-1467GHBK-S all versions, and WRC-1900GHBK-S all versions.
References
Link | Resource |
---|---|
https://jvn.jp/en/vu/JVNVU91630351/ | Third Party Advisory |
https://www.elecom.co.jp/news/security/20230810-01/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
AND |
|
Configuration 3 (hide)
AND |
|
Configuration 4 (hide)
AND |
|
Configuration 5 (hide)
AND |
|
Configuration 6 (hide)
AND |
|
Configuration 7 (hide)
AND |
|
History
23 Aug 2023, 16:48
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
CWE | CWE-78 | |
References | (MISC) https://jvn.jp/en/vu/JVNVU91630351/ - Third Party Advisory | |
References | (MISC) https://www.elecom.co.jp/news/security/20230810-01/ - Vendor Advisory | |
First Time |
Elecom wrc-1467ghbk-a
Elecom wrc-733febk2-a Firmware Elecom wrc-1900ghbk-s Elecom wrc-f1167acf2 Firmware Elecom wrc-1900ghbk-a Elecom wrc-1900ghbk-a Firmware Elecom wrc-1467ghbk-a Firmware Elecom wrc-1467ghbk-s Firmware Elecom wrc-1900ghbk-s Firmware Elecom wrc-600ghbk-a Firmware Elecom wrc-733febk2-a Elecom wrc-1467ghbk-s Elecom Elecom wrc-f1167acf2 Elecom wrc-600ghbk-a |
|
CPE | cpe:2.3:h:elecom:wrc-600ghbk-a:-:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-600ghbk-a_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-733febk2-a:-:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-1467ghbk-s:-:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-733febk2-a_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-1900ghbk-s:-:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-1467ghbk-a_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-1467ghbk-s_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-1467ghbk-a:-:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-f1167acf2_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-1900ghbk-a_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-f1167acf2:-:*:*:*:*:*:*:* cpe:2.3:h:elecom:wrc-1900ghbk-a:-:*:*:*:*:*:*:* cpe:2.3:o:elecom:wrc-1900ghbk-s_firmware:*:*:*:*:*:*:*:* |
18 Aug 2023, 10:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-08-18 10:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-39455
Mitre link : CVE-2023-39455
CVE.ORG link : CVE-2023-39455
JSON object : View
Products Affected
elecom
- wrc-1467ghbk-s_firmware
- wrc-1467ghbk-s
- wrc-600ghbk-a_firmware
- wrc-733febk2-a_firmware
- wrc-1900ghbk-s_firmware
- wrc-600ghbk-a
- wrc-733febk2-a
- wrc-1900ghbk-s
- wrc-1467ghbk-a
- wrc-1467ghbk-a_firmware
- wrc-1900ghbk-a_firmware
- wrc-f1167acf2
- wrc-1900ghbk-a
- wrc-f1167acf2_firmware
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')