Vulnerability · Published Jul 13, 2023 · Assigned by jpcert
CVE-2023-37566
High 8.0
In plain English
A high-severity security flaw in WRC-1167FEBK-A from ELECOM CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Official description
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ELECOM CO.,LTD. | WRC-1167GHBK3-A | v1.24 and earlier |
| ELECOM CO.,LTD. | WRC-1167FEBK-A | v1.18 and earlier |
| ELECOM CO.,LTD. | WRC-F1167ACF2 | all versions |
| ELECOM CO.,LTD. | WRC-600GHBK-A | all versions |
| ELECOM CO.,LTD. | WRC-733FEBK2-A | all versions |
| ELECOM CO.,LTD. | WRC-1467GHBK-A | all versions |
| ELECOM CO.,LTD. | WRC-1900GHBK-A | all versions |
| LOGITEC CORPORATION | LAN-W301NR | all versions |