Log in Start free

Vulnerability · Published Aug 18, 2023 · Assigned by jpcert

CVE-2023-40069

Critical 9.8

In plain English

A critical-severity OS command injection in WRC-1167GHBK2 from ELECOM CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.5%top 26.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-F1167ACF all versions, WRC-1750GHBK all versions, WRC-1167GHBK2 all versions, WRC-1750GHBK2-I all versions, and WRC-1750GHBK-E all versions.

Affected products (as reported)

VendorProductVersions
ELECOM CO.,LTD. WRC-F1167ACF all versions
ELECOM CO.,LTD. WRC-1750GHBK all versions
ELECOM CO.,LTD. WRC-1167GHBK2 all versions
ELECOM CO.,LTD. WRC-1750GHBK2-I all versions
ELECOM CO.,LTD. WRC-1750GHBK-E all versions

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References