« Volver al listado

CVE-2024-34021

Estado: AplazadaMedia (6.8)—

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Elecom — Wireless LAN RouterAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34021",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34021",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-01T13:31:32.438360Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-1167GST2",
          "versions": [
            {
              "status": "affected",
              "version": "v1.32 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-2533GS2V-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-2533GS2-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-2533GS2-W",
          "versions": [
            {
              "status": "affected",
              "version": "v1.68 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-2533GST2",
          "versions": [
            {
              "status": "affected",
              "version": "v1.30 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-1167GS2-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.74 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-1167GS2H-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.74 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-X3200GST3-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.27 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WRC-G01-W",
          "versions": [
            {
              "status": "affected",
              "version": "v1.26 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WMC-2LX-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.42 and earlier"
            }
          ]
        },
        {
          "vendor": "ELECOM CO.,LTD.",
          "product": "WMC-X1800GST-B",
          "versions": [
            {
              "status": "affected",
              "version": "v1.42 and earlier"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:elecom:wrc-2533gs2v-b_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "elecom",
          "product": "wrc-2533gs2v-b_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.68"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "elecom",
          "product": "wrc-2533gs2-b_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.68"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "elecom",
          "product": "wrc-2533gs2-w_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.68"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*"
          ],
          "vendor": "elecom",
          "product": "wrc-2533gst2_firmware",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.30"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-01T02:15:01.873",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN06672778/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.elecom.co.jp/news/security/20240730-01/",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution."
    },
    {
      "lang": "es",
      "value": "Existe una carga sin restricciones de archivos con vulnerabilidad de tipo peligroso en los enrutadores LAN inalámbricos ELECOM. Un usuario que haya iniciado sesión con privilegios administrativos puede cargar un archivo especialmente manipulado en el producto afectado, lo que resultará en la ejecución arbitraria de un comando del sistema operativo."
    }
  ],
  "lastModified": "2026-06-17T07:32:45.723",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}