by Kastro
Paper/Archive/CVE-2023-37567

CVE-2023-37567

ELECOM CO.,LTD. WRC-1167GHBK3-A — Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitra…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.8.838 × 2016.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.

Affected

ProductAffectedFixed inSource
WRC-1167GHBK3-Av1.24 and earlier –CNA
WRC-F1167ACF2all versions –CNA
WRC-600GHBK-Aall versions –CNA
WRC-733FEBK2-Aall versions –CNA
WRC-1467GHBK-Aall versions –CNA
WRC-1900GHBK-Aall versions –CNA
LAN-W301NRall versions–CNA
wrc-1167ghbk3-a≤ 1.24–CISA-ADP
wrc-f1167acf2all versions–CISA-ADP
wrc-600ghbk-aall versions–CISA-ADP
wrc-733febk2-aall versions–CISA-ADP
wrc-1467ghbk-aall versions–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refelecom.co.jp/news/security/20230810-01refelecom.co.jp/news/security/20230711-01refjvn.jp/en/vu/JVNVU91850798