CVE-2021-20860

Published: Dec 1, 2021Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a remote authenticated attacker to hijack the authentication of an administrator via a specially crafted page.

Affected (14)

Products: Elecom: Wrc 1167gst2 Firmware, Wrc 1167gst2a Firmware, Wrc 1167gst2h Firmware, Wrc 2533gs2 B Firmware, Wrc 2533gs2 W Firmware, Wrc 1750gs Firmware, Wrc 1750gsv Firmware, Wrc 1900gst Firmware, Wrc 2533gst Firmware, Wrc 2533gst2 Firmware, Wrc 2533gsta Firmware, Wrc 2533gst2sp Firmware, Wrc 2533gst2 G Firmware, Edwrc 2533gst2 Firmware

Elecom

14 products

Wrc 1167gst2 Firmware

Wrc 1167gst2a Firmware

Wrc 1167gst2h Firmware

Wrc 2533gs2 B Firmware

Wrc 2533gs2 W Firmware

Wrc 2533gst2 Firmware

Wrc 2533gsta Firmware

Wrc 2533gst2sp Firmware

Wrc 2533gst2 G Firmware

Edwrc 2533gst2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1167gst2 Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 1167gst2	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1167gst2a Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 1167gst2a	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1167gst2h Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 1167gst2h	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gs2 B Firmware	Up to 1.52

Running on/with	Platform Versions
Elecom Wrc 2533gs2 B	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gs2 W Firmware	Up to 1.52

Running on/with	Platform Versions
Elecom Wrc 2533gs2 W	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1750gs Firmware	Up to 1.03

Running on/with	Platform Versions
Elecom Wrc 1750gs	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1750gsv Firmware	Up to 2.11

Running on/with	Platform Versions
Elecom Wrc 1750gsv	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 1900gst Firmware	Up to 1.03

Running on/with	Platform Versions
Elecom Wrc 1900gst	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gst Firmware	Up to 1.03

Running on/with	Platform Versions
Elecom Wrc 2533gst	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gst2 Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 2533gst2	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gsta Firmware	Up to 1.03

Running on/with	Platform Versions
Elecom Wrc 2533gsta	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gst2sp Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 2533gst2sp	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Wrc 2533gst2 G Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Wrc 2533gst2 G	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Elecom Edwrc 2533gst2 Firmware	Up to 1.25

Running on/with	Platform Versions
Elecom Edwrc 2533gst2	All versions

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

https://jvn.jp/en/jp/JVN88993473/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://www.elecom.co.jp/news/security/20211130-01/

Source: vultures@jpcert.or.jp

Vendor Advisory

https://jvn.jp/en/jp/JVN88993473/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.elecom.co.jp/news/security/20211130-01/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.