Vulnerabilites related to ELECOM CO.,LTD. - WAB-S1167-PS
jvndb-2024-000088
Vulnerability from jvndb
Published
2024-08-27 14:40
Modified
2024-11-26 15:17
Severity ?
Summary
Multiple vulnerabilities in ELECOM wireless LAN routers and access points
Details
Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.
* Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi (CWE-79) - CVE-2024-34577, CVE-2024-42412
* Missing authentication in Telnet function (CWE-306) - CVE-2024-39300
* Stack-based buffer overflow due to an improper processing of input values in common.cgi (CWE-121) - CVE-2024-43689
CVE-2024-34577
Kentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2024-39300
SASABE Tetsuro reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2024-42412, CVE-2024-43689
RyotaK of Flatt Security Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/jp/JVN24885537/index.html | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2024-34577 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2024-39300 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2024-42412 | |
| CVE | https://www.cve.org/CVERecord?id=CVE-2024-43689 | |
| Buffer Errors(CWE-119) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
| Cross-site Scripting(CWE-79) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
| No Mapping(CWE-Other) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000088.html", "dc:date": "2024-11-26T15:17+09:00", "dcterms:issued": "2024-08-27T14:40+09:00", "dcterms:modified": "2024-11-26T15:17+09:00", description: "Multiple wireless LAN routers and access points provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\n* Cross-site scripting vulnerability due to an improper processing of input values in easysetup.cgi and menu.cgi (CWE-79) - CVE-2024-34577, CVE-2024-42412\r\n\r\n* Missing authentication in Telnet function (CWE-306) - CVE-2024-39300\r\n\r\n* Stack-based buffer overflow due to an improper processing of input values in common.cgi (CWE-121) - CVE-2024-43689\r\n\r\nCVE-2024-34577\r\nKentaro Ishii of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-39300\r\nSASABE Tetsuro reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2024-42412, CVE-2024-43689\r\nRyotaK of Flatt Security Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", link: "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000088.html", "sec:cpe": [ { "#text": "cpe:/a:elecom:wab-i1750-ps", "@product": "WAB-I1750-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/a:elecom:wab-s1167-ps", "@product": "WAB-S1167-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-m1775-ps_firmware", "@product": "WAB-M1775-PS firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s1775_firmware", "@product": "WAB-S1775 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s733mi", "@product": "WAB-S733MI", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x3000gs2-b_firmware", "@product": "WRC-X3000GS2-B firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x3000gs2-w_firmware", "@product": "WRC-X3000GS2-W firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x3000gs2a-b_firmware", "@product": "WRC-X3000GS2A-B firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, ], "sec:cvss": { "@score": "8.8", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0", }, "sec:identifier": "JVNDB-2024-000088", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN24885537/index.html", "@id": "JVN#24885537", "@source": "JVN", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-34577", "@id": "CVE-2024-34577", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-39300", "@id": "CVE-2024-39300", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-42412", "@id": "CVE-2024-42412", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2024-43689", "@id": "CVE-2024-43689", "@source": "CVE", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-119", "@title": "Buffer Errors(CWE-119)", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-Other", "@title": "No Mapping(CWE-Other)", }, ], title: "Multiple vulnerabilities in ELECOM wireless LAN routers and access points", }
jvndb-2023-002797
Vulnerability from jvndb
Published
2023-08-15 11:54
Modified
2025-02-13 15:21
Severity ?
Summary
Multiple vulnerabilities in ELECOM and LOGITEC network devices
Details
Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below.
* Hidden Functionality (CWE-912) - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445
* Telnet service access restriction failure (CWE-284) - CVE-2023-38132
* Hidden Functionality (CWE-912) - CVE-2023-38576
* Buffer overflow (CWE-120) - CVE-2023-39454
* OS Command Injection (CWE-78) - CVE-2023-39455, CVE-2023-40072
* OS Command Injection (CWE-78) - CVE-2023-39944, CVE-2023-40069
Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.
JPCERT/CC coordinated with the developer.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002797.html", "dc:date": "2025-02-13T15:21+09:00", "dcterms:issued": "2023-08-15T11:54+09:00", "dcterms:modified": "2025-02-13T15:21+09:00", description: "Multiple network devices provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below.\r\n\r\n * Hidden Functionality (CWE-912) - CVE-2023-32626, CVE-2023-35991, CVE-2023-39445\r\n * Telnet service access restriction failure (CWE-284) - CVE-2023-38132\r\n * Hidden Functionality (CWE-912) - CVE-2023-38576\r\n * Buffer overflow (CWE-120) - CVE-2023-39454\r\n * OS Command Injection (CWE-78) - CVE-2023-39455, CVE-2023-40072\r\n * OS Command Injection (CWE-78) - CVE-2023-39944, CVE-2023-40069\r\n\r\nChuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.", link: "https://jvndb.jvn.jp/en/contents/2023/JVNDB-2023-002797.html", "sec:cpe": [ { "#text": "cpe:/a:elecom:wab-i1750-ps", "@product": "WAB-I1750-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/a:elecom:wab-s1167-ps", "@product": "WAB-S1167-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-m1775-ps_firmware", "@product": "WAB-M1775-PS firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-m2133_firmware", "@product": "WAB-M2133 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s1167_firmware", "@product": "WAB-S1167 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s1775_firmware", "@product": "WAB-S1775 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s300_firmware", "@product": "WAB-S300", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wab-s600-ps_firmware", "@product": "WAB-S600-PS", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1167ghbk2_firmware", "@product": "WRC-1167GHBK2 firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1467ghbk-a_firmware", "@product": "WRC-1467GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1467ghbk-s_firmware", "@product": "WRC-1467GHBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1750ghbk-e_firmware", "@product": "WRC-1750GHBK-E firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1750ghbk2-i_firmware", "@product": "WRC-1750GHBK2-I firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1750ghbk_firmware", "@product": "WRC-1750GHBK firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1900ghbk-a_firmware", "@product": "WRC-1900GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-1900ghbk-s_firmware", "@product": "WRC-1900GHBK-S", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-600ghbk-a_firmware", "@product": "WRC-600GHBK-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-733febk2-a_firmware", "@product": "WRC-733FEBK2-A", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-f1167acf2_firmware", "@product": "WRC-F1167ACF2", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-f1167acf_firmware", "@product": "WRC-F1167ACF firmware", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x1800gs-b_firmware", "@product": "WRC-X1800GS-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x1800gsa-b_firmware", "@product": "WRC-X1800GSA-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x1800gsh-b_firmware", "@product": "WRC-X1800GSH-B", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x6000qs-g", "@product": "WRC-X6000QS-G", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:elecom:wrc-x6000qsa-g", "@product": "WRC-X6000QSA-G", "@vendor": "ELECOM CO.,LTD.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-w300n%2fdr_firmware", "@product": "LAN-W300N/DR", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-w300n%2fpr5_firmware", "@product": "LAN-W300N/PR5", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-w300n%2fp_firmware", "@product": "LAN-W300N/P firmware", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-w300n%2frs_firmware", "@product": "LAN-W300N/RS firmware", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-w451ngr_firmware", "@product": "LAN-W451NGR", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh300an%2fdgp_firmware", "@product": "LAN-WH300AN/DGP", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh300andgpe_firmware", "@product": "LAN-WH300ANDGPE", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh300n%2fdgp_firmware", "@product": "LAN-WH300N/DGP firmware", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh300n%2fdr_firmware", "@product": "LAN-WH300N/DR", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh300n%2fre_firmware", "@product": "LAN-WH300N/RE", "@vendor": "Logitec Corp.", "@version": "2.2", }, { "#text": "cpe:/o:logitec:lan-wh450n%2fgp_firmware", "@product": "LAN-WH450N/GP", "@vendor": "Logitec Corp.", "@version": "2.2", }, ], "sec:cvss": [ { "@score": "5.8", "@severity": "Medium", "@type": "Base", "@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "@version": "2.0", }, { "@score": "8.8", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0", }, ], "sec:identifier": "JVNDB-2023-002797", "sec:references": [ { "#text": "http://jvn.jp/en/vu/JVNVU91630351/index.html", "@id": "JVNVU#91630351", "@source": "JVN", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-32626", "@id": "CVE-2023-32626", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-35991", "@id": "CVE-2023-35991", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-38132", "@id": "CVE-2023-38132", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-38576", "@id": "CVE-2023-38576", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39445", "@id": "CVE-2023-39445", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39454", "@id": "CVE-2023-39454", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39455", "@id": "CVE-2023-39455", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-39944", "@id": "CVE-2023-39944", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40069", "@id": "CVE-2023-40069", "@source": "CVE", }, { "#text": "https://www.cve.org/CVERecord?id=CVE-2023-40072", "@id": "CVE-2023-40072", "@source": "CVE", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-32626", "@id": "CVE-2023-32626", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-35991", "@id": "CVE-2023-35991", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-38132", "@id": "CVE-2023-38132", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-38576", "@id": "CVE-2023-38576", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39445", "@id": "CVE-2023-39445", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39454", "@id": "CVE-2023-39454", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39455", "@id": "CVE-2023-39455", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-39944", "@id": "CVE-2023-39944", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40069", "@id": "CVE-2023-40069", "@source": "NVD", }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2023-40072", "@id": "CVE-2023-40072", "@source": "NVD", }, { "#text": "https://cwe.mitre.org/data/definitions/120.html", "@id": "CWE-120", "@title": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')(CWE-120)", }, { "#text": "https://cwe.mitre.org/data/definitions/284.html", "@id": "CWE-284", "@title": "Improper Access Control(CWE-284)", }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-78", "@title": "OS Command Injection(CWE-78)", }, { "#text": "https://cwe.mitre.org/data/definitions/912.html", "@id": "CWE-912", "@title": "Hidden Functionality(CWE-912)", }, ], title: "Multiple vulnerabilities in ELECOM and LOGITEC network devices", }
cve-2024-43689
Vulnerability from cvelistv5
Published
2024-10-21 01:27
Modified
2024-11-26 08:03
Severity ?
EPSS score ?
Summary
Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | ELECOM CO.,LTD. | WAB-I1750-PS |
Version: v1.5.10 and earlier |
|||||||||||||||||||||
|
||||||||||||||||||||||||
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:o:elecom:wab-s1167-ps_firmware:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "wab-s1167-ps_firmware", vendor: "elecom", versions: [ { lessThanOrEqual: "1.5.6", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:o:elecom:wab-i1750-ps_firmware:*:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "wab-i1750-ps_firmware", vendor: "elecom", versions: [ { lessThanOrEqual: "1.5.10", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "ADJACENT_NETWORK", availabilityImpact: "HIGH", baseScore: 8.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, }, { other: { content: { id: "CVE-2024-43689", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-10-21T13:40:28.109591Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-10-21T13:46:18.148Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "WAB-I1750-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.10 and earlier", }, ], }, { product: "WAB-M1775-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v2.1.4 and earlier", }, ], }, { product: "WAB-S1167-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.6 and earlier", }, ], }, { product: "WAB-S1775", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v2.1.4 and earlier", }, ], }, { product: "WAB-S733MI", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.3.2 and earlier", }, ], }, ], descriptions: [ { lang: "en", value: "Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.", }, ], metrics: [ { cvssV3_0: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.0", }, format: "CVSS", scenarios: [ { lang: "en-US", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-121", description: "Stack-based buffer overflow", lang: "en-US", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-26T08:03:12.046Z", orgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", shortName: "jpcert", }, references: [ { url: "https://www.elecom.co.jp/news/security/20240827-01/", }, { url: "https://jvn.jp/en/jp/JVN24885537/", }, ], }, }, cveMetadata: { assignerOrgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", assignerShortName: "jpcert", cveId: "CVE-2024-43689", datePublished: "2024-10-21T01:27:15.253Z", dateReserved: "2024-08-16T04:42:09.104Z", dateUpdated: "2024-11-26T08:03:12.046Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2024-42412
Vulnerability from cvelistv5
Published
2024-08-30 06:29
Modified
2024-11-26 08:02
Severity ?
EPSS score ?
Summary
Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | ELECOM CO.,LTD. | WAB-I1750-PS |
Version: v1.5.10 and earlier |
|||||||||||||||||||||
|
||||||||||||||||||||||||
{ containers: { adp: [ { metrics: [ { cvssV3_1: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "NONE", baseScore: 6.1, baseSeverity: "MEDIUM", confidentialityImpact: "LOW", integrityImpact: "LOW", privilegesRequired: "NONE", scope: "CHANGED", userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.1", }, }, { other: { content: { id: "CVE-2024-42412", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-30T14:25:15.511783Z", version: "2.0.3", }, type: "ssvc", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-10-27T15:17:17.839Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { product: "WAB-I1750-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.10 and earlier", }, ], }, { product: "WAB-M1775-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v2.1.4 and earlier", }, ], }, { product: "WAB-S1167-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.6 and earlier", }, ], }, { product: "WAB-S1775", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v2.1.4 and earlier", }, ], }, { product: "WAB-S733MI", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.3.2 and earlier", }, ], }, ], descriptions: [ { lang: "en", value: "Cross-site scripting vulnerability exists in ELECOM wireless access points due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.", }, ], metrics: [ { cvssV3_0: { baseScore: 6.1, baseSeverity: "MEDIUM", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", version: "3.0", }, format: "CVSS", scenarios: [ { lang: "en-US", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-79", description: "Cross-site scripting (XSS)", lang: "en-US", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-11-26T08:02:25.963Z", orgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", shortName: "jpcert", }, references: [ { url: "https://www.elecom.co.jp/news/security/20240827-01/", }, { url: "https://jvn.jp/en/jp/JVN24885537/", }, ], }, }, cveMetadata: { assignerOrgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", assignerShortName: "jpcert", cveId: "CVE-2024-42412", datePublished: "2024-08-30T06:29:27.606Z", dateReserved: "2024-08-16T04:42:08.243Z", dateUpdated: "2024-11-26T08:02:25.963Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }
cve-2023-40072
Vulnerability from cvelistv5
Published
2023-08-18 09:45
Modified
2024-09-09 06:39
Severity ?
EPSS score ?
Summary
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | ELECOM CO.,LTD. | WAB-S600-PS |
Version: all versions |
||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-02T18:24:55.046Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://www.elecom.co.jp/news/security/20231114-01/", }, { tags: [ "x_transferred", ], url: "https://www.elecom.co.jp/news/security/20230810-01/", }, { tags: [ "x_transferred", ], url: "https://jvn.jp/en/vu/JVNVU91630351/", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "WAB-S600-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "all versions", }, ], }, { product: "WAB-S300", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "all versions", }, ], }, { product: "WAB-S1775", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.1.9 and earlier", }, ], }, { product: "WAB-M1775-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.1.21 and earlier", }, ], }, { product: "WAB-S1167", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.0.7 and earlier", }, ], }, { product: "WAB-M2133", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.3.22 and earlier", }, ], }, { product: "WAB-I1750-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.10 and earlier", }, ], }, { product: "WAB-S1167-PS", vendor: "ELECOM CO.,LTD.", versions: [ { status: "affected", version: "v1.5.6 and earlier", }, ], }, ], descriptions: [ { lang: "en", value: "OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.", }, ], problemTypes: [ { descriptions: [ { description: "OS command injection", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2024-09-09T06:39:59.937Z", orgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", shortName: "jpcert", }, references: [ { url: "https://www.elecom.co.jp/news/security/20231114-01/", }, { url: "https://www.elecom.co.jp/news/security/20230810-01/", }, { url: "https://jvn.jp/en/vu/JVNVU91630351/", }, ], }, }, cveMetadata: { assignerOrgId: "ede6fdc4-6654-4307-a26d-3331c018e2ce", assignerShortName: "jpcert", cveId: "CVE-2023-40072", datePublished: "2023-08-18T09:45:31.201Z", dateReserved: "2023-08-09T11:54:59.361Z", dateUpdated: "2024-09-09T06:39:59.937Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }