Sign-up

ID

VAR-202307-0618


CVE

CVE-2023-37564


TITLE

Elecom radio  LAN  router and wireless  LAN  Multiple vulnerabilities in repeaters

Trust: 0.8

sources: JVNDB: JVNDB-2023-000071

DESCRIPTION

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier. None

Trust: 1.71

sources: NVD: CVE-2023-37564 // JVNDB: JVNDB-2023-000071 // VULMON: CVE-2023-37564

AFFECTED PRODUCTS

vendor:elecommodel:wrc-1167gebk-sscope:lteversion:1.03

Trust: 1.0

vendor:elecommodel:wrc-1167febk-ascope:lteversion:1.18

Trust: 1.0

vendor:elecommodel:wrc-1167febk-sscope:lteversion:1.04

Trust: 1.0

vendor:elecommodel:wrc-1167ghbk-sscope:lteversion:1.03

Trust: 1.0

vendor:elecommodel:wrc-1167ghbk3-ascope:lteversion:1.24

Trust: 1.0

vendor:エレコム株式会社model:wrc-600ghbk-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1167ghbk-sscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-733febk2-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-f1167acfscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wtc-300hwhscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1167ghbk3-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wtc-c1167gc-wscope:lteversion:v1.17 and earlier s (cve-2023-37561,cve-2023-37562)

Trust: 0.8

vendor:エレコム株式会社model:wrc-1900ghbk-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1167febk-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1467ghbk-ascope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1167gebk-sscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1167febk-sscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1467ghbk-sscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrh-300wh-hscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wtc-c1167gc-bscope: - version: -

Trust: 0.8

vendor:エレコム株式会社model:wrc-1900ghbk-sscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2023-000071 // NVD: CVE-2023-37564

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2023-37564
value: HIGH

Trust: 1.0

IPA: JVNDB-2023-000071
value: MEDIUM

Trust: 0.8

IPA: JVNDB-2023-000071
severity: HIGH
baseScore: 7.7
vectorString: AV:A/AC:L/AU:S/C:C/I:C/A:C
accessVector: ADJACENT NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

NVD:
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

IPA: JVNDB-2023-000071
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-000071 // NVD: CVE-2023-37564

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [IPA evaluation ]

Trust: 0.8

problemtype: Cross-site scripting (CWE-79) [IPA evaluation ]

Trust: 0.8

problemtype: Code injection (CWE-94) [IPA evaluation ]

Trust: 0.8

problemtype: information leak (CWE-200) [IPA evaluation ]

Trust: 0.8

problemtype: Cross-site request forgery (CWE-352) [IPA evaluation ]

Trust: 0.8

problemtype: others (CWE-Other) [IPA evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2023-000071 // NVD: CVE-2023-37564

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202307-949

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2023-37564

PATCH
title:wireless LAN Request for firmware update to improve router/repeater security ELECOM CO., LTD.url:https://www.elecom.co.jp/news/security/20230711-01/
Trust: 0.8
title:ELECOM WRC Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=246117
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2023-000071 // 
            
            
            
            CNNVD: CNNVD-202307-949

EXTERNAL IDS
db:NVDid:CVE-2023-37564
Trust: 3.3
db:JVNid:JVN05223215
Trust: 2.5
db:JVNDBid:JVNDB-2023-000071
Trust: 1.4
db:CNNVDid:CNNVD-202307-949
Trust: 0.6
db:VULMONid:CVE-2023-37564
Trust: 0.1
sources:
            
            
            VULMON: CVE-2023-37564 // 
            
            
            
            JVNDB: JVNDB-2023-000071 // 
            
            
            
            CNNVD: CNNVD-202307-949 // 
            
            
            
            NVD: CVE-2023-37564

REFERENCES
url:https://www.elecom.co.jp/news/security/20230711-01/
Trust: 1.7
url:https://jvn.jp/en/jp/jvn05223215/
Trust: 1.7
url:https://jvn.jp/jp/jvn05223215/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37560
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37561
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37562
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37563
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37564
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2023-37565
Trust: 0.8
url:https://jvndb.jvn.jp/en/contents/2023/jvndb-2023-000071.html
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2023-37564/
Trust: 0.6
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULMON: CVE-2023-37564 // 
            
            
            
            JVNDB: JVNDB-2023-000071 // 
            
            
            
            CNNVD: CNNVD-202307-949 // 
            
            
            
            NVD: CVE-2023-37564

SOURCES
db:VULMONid:CVE-2023-37564
db:JVNDBid:JVNDB-2023-000071
db:CNNVDid:CNNVD-202307-949
db:NVDid:CVE-2023-37564

LAST UPDATE DATE
2024-03-29T22:36:08.217000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2023-37564date:2023-07-13T00:00:00
db:JVNDBid:JVNDB-2023-000071date:2024-03-29T06:15:00
db:CNNVDid:CNNVD-202307-949date:2023-07-14T00:00:00
db:NVDid:CVE-2023-37564date:2023-07-25T14:49:22.723

SOURCES RELEASE DATE
db:VULMONid:CVE-2023-37564date:2023-07-13T00:00:00
db:JVNDBid:JVNDB-2023-000071date:2023-07-11T00:00:00
db:CNNVDid:CNNVD-202307-949date:2023-07-11T00:00:00
db:NVDid:CVE-2023-37564date:2023-07-13T04:15:10.213