CVE-2024-39607: ELECOM CO.,LTD. WRC-X1500GS-B, инжекция

Описание

Оригинално описание

OS command injection vulnerability exists in ELECOM wireless LAN routers. A specially crafted request may be sent to the affected product by a logged-in user with an administrative privilege to execute an arbitrary OS command.

Засегнати продукти

• ELECOM CO.,LTD. WRC-X1500GS-B: v1.11 and earlier
• ELECOM CO.,LTD. WRC-X1500GSA-B: v1.11 and earlier
• ELECOM CO.,LTD. WRC-X1800GS-B: v1.18 and earlier
• ELECOM CO.,LTD. WRC-X1800GSA-B: v1.18 and earlier
• ELECOM CO.,LTD. WRC-X1800GSH-B: v1.18 and earlier
• ELECOM CO.,LTD. WRC-X3000GS2-B: v1.08 and earlier
• ELECOM CO.,LTD. WRC-X3000GS2-W: v1.08 and earlier
• ELECOM CO.,LTD. WRC-X3000GS2A-B: v1.08 and earlier
• ELECOM CO.,LTD. WRC-XE5400GS-G: v1.12 and earlier
• ELECOM CO.,LTD. WRC-XE5400GSA-G: v1.12 and earlier
• ELECOM CO.,LTD. WRC-X6000QS-G: v1.13 and earlier
• ELECOM CO.,LTD. WRC-X6000QSA-G: v1.13 and earlier
• ELECOM CO.,LTD. WRC-X6000XS-G: v1.11 and earlier
• ELECOM CO.,LTD. WRC-X6000XST-G: v1.14 and earlier
• ELECOM CO.,LTD. WRC-X3000GST2-B: v1.06 and earlier
• elecom: още 3 продукта, добавени от elecom

  wrc-x6000xs-g_firmware, wrc-x1500gs-b_firmware, wrc-x1500gsa-b_firmware

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в ELECOM CO.,LTD. WRC-X1500GS-B

• 6.9CVE-2026-25107
• 5.1CVE-2026-24449
• 8.6CVE-2026-22550
• 5.1CVE-2026-20704
• 4.6CVE-2024-34577

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-39607
• https://nvd.nist.gov/vuln/detail/CVE-2024-39607
• https://www.elecom.co.jp/news/security/20240730-01/
• https://jvn.jp/en/jp/JVN06672778/