CVE-2024-23910
High
Description
Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B".
SeverityHigh
CVSS8.8
Exploit probability—
ProductElecom Wmc-x1800gst-b Firmware
PublishedFeb 28, 2024
First seenFeb 28, 2024
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- elecom wmc-x1800gst-b_firmware1.42 or later
- elecom wrc-1167gs2-b_firmware1.73 or later
- elecom wrc-1167gs2h-b_firmware1.73 or later
- elecom wrc-1167gst2_firmware1.34 or later
- elecom wrc-2533gs2-b_firmware1.68 or later
- elecom wrc-2533gs2-w_firmware1.68 or later
- elecom wrc-2533gs2v-b_firmware1.68 or later
- elecom wrc-2533gst2_firmware1.31 or later
- elecom wrc-x3200gst3-b_firmware1.27 or later
- elecom wrc-g01-w_firmware1.26 or later
- elecom wsc-x1800gs-b_firmware1.42 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| elecom wmc-x1800gst-b_firmware | v < 1.42 | 1.42 |
| elecom wrc-1167gs2-b_firmware | v < 1.73 | 1.73 |
| elecom wrc-1167gs2h-b_firmware | v < 1.73 | 1.73 |
| elecom wrc-1167gst2_firmware | v < 1.34 | 1.34 |
| elecom wrc-2533gs2-b_firmware | v < 1.68 | 1.68 |
| elecom wrc-2533gs2-w_firmware | v < 1.68 | 1.68 |
| elecom wrc-2533gs2v-b_firmware | v < 1.68 | 1.68 |
| elecom wrc-2533gst2_firmware | v < 1.31 | 1.31 |
| elecom wrc-x3200gst3-b_firmware | v < 1.27 | 1.27 |
| elecom wrc-g01-w_firmware | v < 1.26 | 1.26 |
| elecom wsc-x1800gs-b_firmware | v < 1.42 | 1.42 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.