CVE-2024-40883

HIGH

ELECOM Wireless LAN Routers - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc.

References (2)

Core 2
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN06672778/

Scores

CVSS v3 8.8
EPSS 0.0020
EPSS Percentile 9.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (21)
elecom/wrc-2533gs2-b_firmware < 1.69
elecom/wrc-2533gs2-w_firmware < 1.69
elecom/wrc-2533gs2v-b_firmware < 1.69
elecom/wrc-x1500gs-b_firmware < 1.12
elecom/wrc-x1500gsa-b_firmware < 1.12
elecom/wrc-x6000xs-g_firmware < 1.12
ELECOM CO.,LTD./WRC-X1500GS-B v1.11 and earlier
ELECOM CO.,LTD./WRC-X1500GSA-B v1.11 and earlier
ELECOM CO.,LTD./WRC-X1800GS-B v1.18 and earlier
ELECOM CO.,LTD./WRC-X1800GSA-B v1.18 and earlier
... and 11 more
Published Aug 01, 2024
Tracked Since Feb 18, 2026