Vulnerability · Published Jul 13, 2023 · Assigned by jpcert
CVE-2023-37567
Critical 9.8
In plain English
A critical-severity security flaw in WRC-1167GHBK3-A from ELECOM CO.,LTD.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Official description
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ELECOM CO.,LTD. | WRC-1167GHBK3-A | v1.24 and earlier |
| ELECOM CO.,LTD. | WRC-F1167ACF2 | all versions |
| ELECOM CO.,LTD. | WRC-600GHBK-A | all versions |
| ELECOM CO.,LTD. | WRC-733FEBK2-A | all versions |
| ELECOM CO.,LTD. | WRC-1467GHBK-A | all versions |
| ELECOM CO.,LTD. | WRC-1900GHBK-A | all versions |
| LOGITEC CORPORATION | LAN-W301NR | all versions |