CVE-2023-37563 - OpenCVE

ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Elecom	Wrc-1167febk-a Firmware Wrc-1167ghbk3-a Firmware Wrc-1167gebk-s Firmware Wrc-1167ghbk-s Wrc-1167febk-s Firmware Wrc-1167febk-s Wrc-1167ghbk3-a Wrc-1167febk-a Wrc-1167ghbk-s Firmware Wrc-1167gebk-s

Configuration 1 [-]

AND

cpe:2.3:o:elecom:wrc-1167ghbk-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167ghbk-s:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:elecom:wrc-1167gebk-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167gebk-s:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:elecom:wrc-1167febk-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167febk-s:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:elecom:wrc-1167ghbk3-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167ghbk3-a:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:elecom:wrc-1167febk-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1167febk-a:-:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/jp/JVN05223215/	Third Party Advisory
https://www.elecom.co.jp/news/security/20230711-01/	Vendor Advisory
https://www.elecom.co.jp/news/security/20230810-01/

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2023-07-13T02:59:04.187Z

Updated: 2023-08-18T09:31:52.811Z

Reserved: 2023-07-07T08:46:11.998Z

Link: CVE-2023-37563

JSON object: View

NVD Information

Status : Modified

Published: 2023-07-13T03:15:09.927

Modified: 2023-08-18T10:15:10.483

Link: CVE-2023-37563

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2023-37563", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-07-07T08:46:11.998Z", "datePublished": "2023-07-13T02:59:04.187Z", "dateUpdated": "2023-08-18T09:31:52.811Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-1167GHBK-S", "versions": [{"version": "v1.03 and earlier ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1167GEBK-S", "versions": [{"version": "v1.03 and earlier ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1167FEBK-S", "versions": [{"version": "v1.04 and earlier ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1167GHBK3-A", "versions": [{"version": "v1.24 and earlier ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1167FEBK-A", "versions": [{"version": "v1.18 and earlier ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-F1167ACF2", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-600GHBK-A", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-733FEBK2-A", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1467GHBK-A", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1467GHBK-S", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1900GHBK-A", "versions": [{"version": "all versions ", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-1900GHBK-S", "versions": [{"version": "all versions", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions."}], "problemTypes": [{"descriptions": [{"description": "Information disclosure", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20230810-01/"}, {"url": "https://www.elecom.co.jp/news/security/20230711-01/"}, {"url": "https://jvn.jp/en/jp/JVN05223215/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-08-18T09:31:52.811Z"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167ghbk-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "73FE02E7-2700-4C34-8DA7-F04040ABD427", "versionEndIncluding": "1.03", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167ghbk-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "5EA23990-CAE0-4EDE-8355-530CB0D72288", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167gebk-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D15FBA3F-C309-4B24-B4B0-FF271DC24681", "versionEndIncluding": "1.03", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167gebk-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "1840F3EA-A2F1-4E0D-A179-A0141BDA1760", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167febk-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7200E9A-0713-461F-AD6D-03151D62F0B0", "versionEndIncluding": "1.04", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167febk-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "F7EF5A7C-3EEA-4592-A25C-E254DF703FFF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167ghbk3-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "CDA47F4E-73D6-4F96-8EF4-8896701F6990", "versionEndIncluding": "1.24", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167ghbk3-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "C6248727-0D48-44DA-A44A-87FD71ECEDA6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167febk-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2FA6AB13-9CBF-46A1-89E8-1D341E6FBE03", "versionEndIncluding": "1.18", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167febk-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "9F6BA0C4-7C5C-4BF3-A268-4978590041E6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "ELECOM wireless LAN routers are vulnerable to sensitive information exposure, which allows a network-adjacent unauthorized attacker to obtain sensitive information. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, WRC-1167FEBK-A v1.18 and earlier, WRC-F1167ACF2 all versions, WRC-600GHBK-A all versions, WRC-733FEBK2-A all versions, WRC-1467GHBK-A all versions, WRC-1467GHBK-S all versions, WRC-1900GHBK-A all versions, and WRC-1900GHBK-S all versions."}], "id": "CVE-2023-37563", "lastModified": "2023-08-18T10:15:10.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-07-13T03:15:09.927", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN05223215/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20230711-01/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.elecom.co.jp/news/security/20230810-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}