Medium severity · published Feb 28, 2024
CVE-2024-21798
ELECOM wireless LAN routers contain a cross-site scripting vulnerability
4.8
CVSS
1.3%
EPSS
No
On KEV
Description
ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
WMC-X1800GST-B · ELECOM CO.,LTD.
v1.41 and earlier · source: vendor
WR
WRC-1167GS2-B · ELECOM CO.,LTD.
v1.67 and earlier · source: vendor
WR
WRC-1167GS2H-B · ELECOM CO.,LTD.
v1.67 and earlier · source: vendor
WR
WRC-1167GST2 · ELECOM CO.,LTD.
v1.32 and earlier · source: vendor
WR
WRC-2533GS2-B · ELECOM CO.,LTD.
v1.62 and earlier · source: vendor
WR
WRC-2533GS2-W · ELECOM CO.,LTD.
v1.62 and earlier · source: vendor
WR
WRC-2533GS2V-B · ELECOM CO.,LTD.
v1.62 and earlier · source: vendor
WR
WRC-2533GST2 · ELECOM CO.,LTD.
v1.30 and earlier · source: vendor
WR
WRC-G01-W · ELECOM CO.,LTD.
v1.24 and earlier · source: vendor
WR
WRC-X3200GST3-B · ELECOM CO.,LTD.
v1.25 and earlier · source: vendor
WF
Wmc-x1800gst-b Firmware · Elecom
before 1.42 · source: NVD
WF
Wrc-1167gs2-b Firmware · Elecom
before 1.73 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21798
Third Party Advisory
https://jvn.jp/en/jp/JVN44166658/
Vendor Advisory
https://www.elecom.co.jp/news/security/20240220-01/
More from WMC-X1800GST-B
8.8
CVE-2024-25568
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially…
8.8
CVE-2024-23910
Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of…
7.1
CVE-2024-26258
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially…
6.8
CVE-2024-34021
Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers
6.8
CVE-2024-25579
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a…