Published:2024/05/28 Last Updated:2024/05/28
JVNVU#97214223
ELECOM wireless LAN routers vulnerable to OS command injection
Overview
Multiple wireless LAN routers provided by ELECOM CO.,LTD. contain an OS command injection vulnerability.
Products Affected
- WRC-X5400GS-B v1.0.10 and earlier
- WRC-X5400GSA-B v1.0.10 and earlier
Description
Wireless LAN routers provided by ELECOM CO.,LTD. contain an OS command injection vulnerability (CWE-78).
Impact
If a user who can log in to the product sends a specially crafted request to the affected product, an arbitrary OS command may be executed.
Solution
Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
Vendor Status
| Vendor | Status | Last Update | Vendor Notes |
|---|---|---|---|
| ELECOM CO.,LTD. | Vulnerable | 2024/05/28 | ELECOM CO.,LTD. website |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score:
6.8
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
Credit
Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2024-36103 |
| JVN iPedia |
|