Read the docs
TI-2023-18050 Aliases CVE-2023-35991GHSA-jfx7-937f-3p2w

Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Affected products and versions are as follows: LAN-W300N/DR all versions, LAN-WH300N/DR all versions, LAN-W300N/P all versions, LAN-WH450N/GP all versions, LAN-WH300AN/DGP all versions, LAN-WH300N/DGP all versions, and LAN-WH300ANDGPE all versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00723 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LOGITEC CORPORATIONLAN-W300N/DRall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-WH300N/DRall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-W300N/Pall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-WH450N/GPall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-WH300AN/DGPall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-WH300N/DGPall versions—No fix listedCNA
LOGITEC CORPORATIONLAN-WH300ANDGPEall versions—No fix listedCNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:o:elecom:lan-wh300andgpe_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-wh300andgpe:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:lan-wh300n\/dgp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-wh300n\/dgp:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:lan-wh300an\/dgp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-wh300an\/dgp:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:lan-wh450n\/gp_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-wh450n\/gp:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:lan-w300n\/p_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-w300n\/p:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-wh300andgpe_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-wh300andgpe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-wh300n\/dgp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-wh300n\/dgp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-wh300an\/dgp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-wh300an\/dgp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-wh450n\/gp_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-wh450n\/gp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-w300n\/p_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-w300n\/p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:elecom:lan-wh300n\/dr_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-wh300n\/dr:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
cpe:2.3:o:elecom:lan-w300n\/dr_firmware:*:*:*:*:*:*:*:*all versionsVulnerableELECOM CO.,LTD.
cpe:2.3:h:elecom:lan-w300n\/dr:-:*:*:*:*:*:*:*not specified by NVDRunning onELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-wh300n\/dr_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-wh300n\/dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
  • cpe:2.3:o:elecom:lan-w300n\/dr_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·ELECOM CO.,LTD.
  • cpe:2.3:h:elecom:lan-w300n\/dr:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-35991
  2. 2026-10-03 Alias added: GHSA-jfx7-937f-3p2w

References

Advisory 2

  • TI-2007-02825 Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a)… CVSS 2.0MEDIUM 6.8
  • TI-2023-19165 Command injection in ELECOM CO.,LTD. WRC-1167GHBK3-A CVSS 3.1CRITICAL 9.8
  • TI-2012-01147 Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login… CVSS 2.0HIGH 10.0
  • TI-2008-00917 Multiple stack-based buffer overflows in the BackWeb Lite Install Runner ActiveX control… CVSS 2.0HIGH 9.3
  • TI-2018-11211 Origin validation error in Logitech Harmony Hub CVSS 3.0CRITICAL 9.8
  • TI-2018-11209 Improper authentication in Logitech Harmony Hub CVSS 3.0CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences