Vulnerability · Published Jul 7, 2021 · Assigned by jpcert

CVE-2021-20739

High 8.8

In plain English

A high-severity security flaw in WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S from ELECOM CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS NVD)8.8High

Exploit odds (30 days)0.5%top 56.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors.

Affected products (as reported)

Vendor	Product	Versions
ELECOM CO.,LTD.	WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S	all versions

References

https://www.elecom.co.jp/news/security/20210706-01/ x_refsource_MISC
https://jvn.jp/en/vu/JVNVU94260088/index.html x_refsource_MISC