8

CVE-2021-20863

OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attackers to execute an arbitrary OS command with the root privilege via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elecom ≫ Wrc-1167gst2 Firmware Version <= 1.25
   Elecom ≫ Wrc-1167gst2 Version -
Elecom ≫ Wrc-1167gst2a Firmware Version <= 1.25
   Elecom ≫ Wrc-1167gst2a Version -
Elecom ≫ Wrc-1167gst2h Firmware Version <= 1.25
   Elecom ≫ Wrc-1167gst2h Version -
Elecom ≫ Wrc-2533gs2-b Firmware Version <= 1.52
   Elecom ≫ Wrc-2533gs2-b Version -
Elecom ≫ Wrc-2533gs2-w Firmware Version <= 1.52
   Elecom ≫ Wrc-2533gs2-w Version -
Elecom ≫ Wrc-1750gs Firmware Version <= 1.03
   Elecom ≫ Wrc-1750gs Version -
Elecom ≫ Wrc-1750gsv Firmware Version <= 2.11
   Elecom ≫ Wrc-1750gsv Version -
Elecom ≫ Wrc-1900gst Firmware Version <= 1.03
   Elecom ≫ Wrc-1900gst Version -
Elecom ≫ Wrc-2533gst Firmware Version <= 1.03
   Elecom ≫ Wrc-2533gst Version -
Elecom ≫ Wrc-2533gst2 Firmware Version <= 1.25
   Elecom ≫ Wrc-2533gst2 Version -
Elecom ≫ Wrc-2533gsta Firmware Version <= 1.03
   Elecom ≫ Wrc-2533gsta Version -
Elecom ≫ Wrc-2533gst2sp Firmware Version <= 1.25
   Elecom ≫ Wrc-2533gst2sp Version -
Elecom ≫ Wrc-2533gst2-g Firmware Version <= 1.25
   Elecom ≫ Wrc-2533gst2-g Version -
Elecom ≫ Edwrc-2533gst2 Firmware Version <= 1.25
   Elecom ≫ Edwrc-2533gst2 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.86% 0.537
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.7 5.1 10
AV:A/AC:L/Au:S/C:C/I:C/A:C
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.elecom.co.jp/news/security/20211130-01/
Vendor Advisory
https://jvn.jp/en/vu/JVNVU94527926/index.html
Third Party Advisory