Command injection in ELECOM CO.,LTD. WRC-1167GHBK3-A
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1900GHBK-A all versions, and LAN-W301NR all versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ELECOM CO.,LTD. | WRC-1167GHBK3-A | up to v1.24 | — | No fix listed | CNA |
| ELECOM CO.,LTD. | WRC-F1167ACF2 | all versions | — | No fix listed | CNA |
| ELECOM CO.,LTD. | WRC-600GHBK-A | all versions | — | No fix listed | CNA |
| ELECOM CO.,LTD. | WRC-733FEBK2-A | all versions | — | No fix listed | CNA |
| ELECOM CO.,LTD. | WRC-1467GHBK-A | all versions | — | No fix listed | CNA |
| ELECOM CO.,LTD. | WRC-1900GHBK-A | all versions | — | No fix listed | CNA |
| LOGITEC CORPORATION | LAN-W301NR | all versions | — | No fix listed | CNA |
- WRC-1167GHBK3-A VendorELECOM CO.,LTD. Affected up to v1.24 Fixed in — No fix listed CNA
- WRC-F1167ACF2 VendorELECOM CO.,LTD. Affected all versions Fixed in — No fix listed CNA
- WRC-600GHBK-A VendorELECOM CO.,LTD. Affected all versions Fixed in — No fix listed CNA
- WRC-733FEBK2-A VendorELECOM CO.,LTD. Affected all versions Fixed in — No fix listed CNA
- WRC-1467GHBK-A VendorELECOM CO.,LTD. Affected all versions Fixed in — No fix listed CNA
- WRC-1900GHBK-A VendorELECOM CO.,LTD. Affected all versions Fixed in — No fix listed CNA
- LAN-W301NR VendorLOGITEC CORPORATION Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:elecom:wrc-1167ghbk3-a_firmware:*:*:*:*:*:*:*:* | up to 1.24 | Vulnerable | ELECOM CO.,LTD. |
| cpe:2.3:h:elecom:wrc-1167ghbk3-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ELECOM CO.,LTD. |
- cpe:2.3:o:elecom:wrc-1167ghbk3-a_firmware:*:*:*:*:*:*:*:* Versions up to 1.24 Vulnerable ·ELECOM CO.,LTD.
- cpe:2.3:h:elecom:wrc-1167ghbk3-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ELECOM CO.,LTD.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37567
- 2026-10-03 Alias added: GHSA-4g64-j4r5-wvxc
References
More ELECOM CO.,LTD. Wrc-1167ghbk3-a Firmware vulnerabilities
- TI-2023-19164 Command injection in ELECOM CO.,LTD. WRC-1167GHBK3-A CVSS 3.1HIGH 8.0
- TI-2023-19162 OS command injection in ELECOM CO.,LTD. WRC-1167GHBK-S CVSS 3.1HIGH 8.0
- TI-2023-19163 Code injection in ELECOM CO.,LTD. WRC-1167GHBK-S CVSS 3.1HIGH 8.0
- TI-2023-19161 Insecure storage of sensitive information in ELECOM CO.,LTD. WRC-1167GHBK-S CVSS 3.1MEDIUM 6.5
Sources
- CVE-2023-37567 · CVE Program
- CVE-2023-37567 · NVD
- FIRST EPSS
- GHSA-4g64-j4r5-wvxc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences