8

CVE-2023-37565

Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Elecom ≫ Wrc-1167ghbk-s Firmware Version <= 1.03
   Elecom ≫ Wrc-1167ghbk-s Version-
Elecom ≫ Wrc-1167gebk-s Firmware Version <= 1.03
   Elecom ≫ Wrc-1167gebk-s Version-
Elecom ≫ Wrc-1167febk-s Firmware Version <= 1.04
   Elecom ≫ Wrc-1167febk-s Version-
Elecom ≫ Wrc-1167ghbk3-a Firmware Version <= 1.24
   Elecom ≫ Wrc-1167ghbk3-a Version-
Elecom ≫ Wrc-1167febk-a Firmware Version <= 1.18
   Elecom ≫ Wrc-1167febk-a Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.15% 0.359
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8 2.1 5.9
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

https://jvn.jp/en/jp/JVN05223215/
Third Party Advisory