Medium severity · published Feb 28, 2024
CVE-2024-21798
ELECOM wireless LAN routers contain a cross-site scripting vulnerability
4.8
CVSS
1.3%
EPSS
No
On KEV
Description
ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
Wmc-x1800gst-b Firmware · Elecom
before 1.42 · source: NVD
WF
Wrc-1167gs2-b Firmware · Elecom
before 1.73 · source: NVD
WF
Wrc-1167gs2h-b Firmware · Elecom
before 1.73 · source: NVD
WF
Wrc-1167gst2 Firmware · Elecom
before 1.34 · source: NVD
WF
Wrc-2533gs2-b Firmware · Elecom
before 1.68 · source: NVD
WF
Wrc-2533gs2-w Firmware · Elecom
before 1.68 · source: NVD
WF
Wrc-2533gs2v-b Firmware · Elecom
before 1.68 · source: NVD
WF
Wrc-2533gst2 Firmware · Elecom
before 1.31 · source: NVD
WF
Wrc-g01-w Firmware · Elecom
before 1.26 · source: NVD
WF
Wrc-x3200gst3-b Firmware · Elecom
before 1.27 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-21798
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-21798
Third Party Advisory
https://jvn.jp/en/jp/JVN44166658/
Vendor Advisory
https://www.elecom.co.jp/news/security/20240220-01/
More from Wmc-x1800gst-b Firmware
8.8
CVE-2024-23910
Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of…