JVNDB-2021-004912

Vulnerability from jvndb - Published: 2021-12-02 08:16 - Updated:2022-03-30 07:11
Severity
8.8 (High) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Multiple vulnerabilities in multiple ELECOM routers
Details
Multiple routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below. * Improper access control leading to unauthorized activation of telnet service (CWE-284) - CVE-2021-20862 * OS command injection (CWE-78) - CVE-2021-20863 * Improper access control leading to unauthorized activation of telnet service (CWE-284) - CVE-2021-20864 Chuya Hayakawa and Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported this vulnerability to ELECOM CO.,LTD. and coordinated. ELECOM CO.,LTD. and JPCERT/CC published respective advisories in order to notify users of these vulnerabilities.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-004912.html",
  "dc:date": "2022-03-30T16:11+09:00",
  "dcterms:issued": "2021-12-02T17:16+09:00",
  "dcterms:modified": "2022-03-30T16:11+09:00",
  "description": "Multiple routers provided by ELECOM CO.,LTD. contain multiple vulnerabilities listed below.\r\n\r\n  * Improper access control leading to unauthorized activation of telnet service (CWE-284) - CVE-2021-20862\r\n\r\n  * OS command injection (CWE-78) - CVE-2021-20863\r\n\r\n  * Improper access control leading to unauthorized activation of telnet service \r\n(CWE-284) - CVE-2021-20864\r\n\r\nChuya Hayakawa and Katsuhiko Sato(a.k.a. goroh_kun) of 00One, Inc. reported this vulnerability to ELECOM CO.,LTD. and coordinated. ELECOM CO.,LTD. and JPCERT/CC published respective advisories in order to notify users of these vulnerabilities.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-004912.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:elecom:edwrc-2533gst2_firmware",
      "@product": "EDWRC-2533GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wmc-2hc-w_firmware",
      "@product": "WMC-2HC-W firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wmc-c2533gst-w_firmware",
      "@product": "WMC-C2533GST-W firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wmc-dlgst2-w_firmware",
      "@product": "WMC-DLGST2-W firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wmc-m1267gst2-w_firmware",
      "@product": "WMC-M1267GST2-W firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2-b_firmware",
      "@product": "WRC-1167GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gs2h-b_firmware",
      "@product": "WRC-1167GS2H-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gst2a_firmware",
      "@product": "WRC-1167GST2A firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gst2h_firmware",
      "@product": "WRC-1167GST2H firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1167gst2_firmware",
      "@product": "WRC-1167GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1750gst2_firmware",
      "@product": "WRC-1750GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1750gsv_firmware",
      "@product": "WRC-1750GSV firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1750gs_firmware",
      "@product": "WRC-1750GS firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1900gst2sp_firmware",
      "@product": "WRC-1900GST2SP firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1900gst2_firmware",
      "@product": "WRC-1900GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-1900gst_firmware",
      "@product": "WRC-1900GST firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-b_firmware",
      "@product": "WRC-2533GS2-B",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gs2-w_firmware",
      "@product": "WRC-2533GS2-W",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gst2-g_firmware",
      "@product": "WRC-2533GST2-G firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gst2sp_firmware",
      "@product": "WRC-2533GST2SP firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gst2_firmware",
      "@product": "WRC-2533GST2 firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gsta_firmware",
      "@product": "WRC-2533GSTA firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:elecom:wrc-2533gst_firmware",
      "@product": "WRC-2533GST firmware",
      "@vendor": "ELECOM CO.,LTD.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "7.7",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
      "@version": "2.0"
    },
    {
      "@score": "8.8",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-004912",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/vu/JVNVU94527926/index.html",
      "@id": "JVNVU#94527926",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20862",
      "@id": "CVE-2021-20862",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20863",
      "@id": "CVE-2021-20863",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20864",
      "@id": "CVE-2021-20864",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20862",
      "@id": "CVE-2021-20862",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20863",
      "@id": "CVE-2021-20863",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20864",
      "@id": "CVE-2021-20864",
      "@source": "NVD"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/284.html",
      "@id": "CWE-284",
      "@title": "Improper Access Control(CWE-284)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "Multiple vulnerabilities in multiple ELECOM routers"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.