CVE-2020-5634 - OpenCVE

ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:A/AC:L/Au:N/C:C/I:C/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Elecom	Wrc-2533gst2 Firmware Wrc-1167gst2 Wrc-1750gst2 Firmware Wrc-1900gst2 Wrc-1750gst2 Wrc-1167gst2 Firmware Wrc-2533gst2 Wrc-1900gst2 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-2533gst2:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:elecom:wrc-1900gst2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1900gst2:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:elecom:wrc-1750gst2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1750gst2:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:elecom:wrc-1167gst2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167gst2:-:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/jp/JVN82892096/index.html	Third Party Advisory
https://www.elecom.co.jp/news/security/20201005-01/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2020-10-06T05:00:27

Updated: 2020-10-06T05:00:27

Reserved: 2020-01-06T00:00:00

Link: CVE-2020-5634

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-10-06T06:15:12.653

Modified: 2020-10-13T17:33:21.393

Link: CVE-2020-5634

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"containers": {"cna": {"affected": [{"product": "ELECOM LAN routers", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10"}]}], "descriptions": [{"lang": "en", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "OS Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-06T05:00:27", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.elecom.co.jp/news/security/20201005-01/"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2020-5634", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ELECOM LAN routers", "version": {"version_data": [{"version_value": "WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10"}]}}]}, "vendor_name": "ELECOM CO.,LTD."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "OS Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.elecom.co.jp/news/security/20201005-01/", "refsource": "MISC", "url": "https://www.elecom.co.jp/news/security/20201005-01/"}, {"name": "https://jvn.jp/en/jp/JVN82892096/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}]}}}}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2020-5634", "datePublished": "2020-10-06T05:00:27", "dateReserved": "2020-01-06T00:00:00", "dateUpdated": "2020-10-06T05:00:27", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADE64129-08D1-44B4-ACEE-2A6430AD57F3", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-2533gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "85BF0A23-43C9-4497-BDDF-9366642503ED", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1900gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F9BF39B-5EF4-49B3-8C4D-52065361A653", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1900gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "44AEB29B-9370-4C4A-8CEF-A1127FB48682", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1750gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "07BB2AC6-C2ED-4EBD-BE4B-CB7528DDCA3F", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1750gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "BD054832-3D35-40BF-B9DB-D0AC6C8AB000", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F07994E-A952-40E2-8C78-AA5FD1794E5F", "versionEndExcluding": "1.10", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9045F74-985E-4C3C-AC10-14FD9B61A746", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}, {"lang": "es", "value": "Los enrutadores LAN ELECOM (versiones de firmware WRC-2533GST2 anteriores a v1.14, versiones de firmware WRC-1900GST2 anteriores a v1.14, versiones de firmware WRC-1750GST2 anteriores a v1.14 y versiones de firmware WRC-1167GST2 anteriores a v1.10), permite a un atacante en el mismo segmento de red ejecutar comandos arbitrarios de Sistema Operativo con un privilegio root por medio de vectores no especificados"}], "id": "CVE-2020-5634", "lastModified": "2020-10-13T17:33:21.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-06T06:15:12.653", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20201005-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}