CVE-2023-39445 - OpenCVE

Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted file to the product's certain management console.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Elecom	Wrc-1900ghbk-s Wrc-1467ghbk-s Wrc-733febk2-a Wrc-1900ghbk-s Firmware Wrc-600ghbk-a Wrc-1900ghbk-a Wrc-733febk2-a Firmware Wrc-1467ghbk-a Firmware Wrc-1467ghbk-a Wrc-f1167acf2 Wrc-600ghbk-a Firmware Wrc-f1167acf2 Firmware Wrc-1900ghbk-a Firmware Wrc-1467ghbk-s Firmware

Configuration 1 [-]

AND

cpe:2.3:o:elecom:wrc-1467ghbk-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1467ghbk-a:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:elecom:wrc-1467ghbk-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1467ghbk-s:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:elecom:wrc-1900ghbk-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1900ghbk-a:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:elecom:wrc-1900ghbk-s_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-1900ghbk-s:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:elecom:wrc-600ghbk-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-600ghbk-a:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:elecom:wrc-733febk2-a_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-733febk2-a:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:elecom:wrc-f1167acf2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:elecom:wrc-f1167acf2:-:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/vu/JVNVU91630351/	Third Party Advisory
https://www.elecom.co.jp/news/security/20230810-01/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: jpcert

Published: 2023-08-18T09:40:17.145Z

Updated: 2023-08-18T09:40:17.145Z

Reserved: 2023-08-09T11:54:56.682Z

Link: CVE-2023-39445

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-08-18T10:15:12.037

Modified: 2023-08-24T18:30:33.000

Link: CVE-2023-39445

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-Other

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1467ghbk-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC533672-D149-4A6B-A60F-E5888A4D0866", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1467ghbk-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "9EE63634-3DBE-4B5F-B871-F076238BC4C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1467ghbk-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F19CD96A-4C04-4BFA-9E4D-8FC5E9E5E234", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1467ghbk-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "376A8656-1F77-4F34-B644-5DB95CEE1FD8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1900ghbk-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6924154-8795-4E5D-8DA3-6EB49EEA2EC0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1900ghbk-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9EEA205-6C7C-4AB3-BAEF-30249B176DE8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1900ghbk-s_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0420E3E-E12A-471E-8EE1-67E2BC70D3CA", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1900ghbk-s:-:*:*:*:*:*:*:*", "matchCriteriaId": "20D26F24-2789-4111-983D-F3CF358E5B19", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-600ghbk-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "59693326-E999-4115-BB4D-67C6B6A6FC4F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-600ghbk-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "62FEEDBD-C39E-46C4-87E7-B59967845A42", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-733febk2-a_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3ADFE2B7-2D1A-42A1-9BB5-BEB940464D53", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-733febk2-a:-:*:*:*:*:*:*:*", "matchCriteriaId": "B2468934-2A7D-4DD7-8145-7F3E86F12BB1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-f1167acf2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7236FA68-7625-427E-AD31-995EE0CAD0F9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-f1167acf2:-:*:*:*:*:*:*:*", "matchCriteriaId": "A01DD657-E35F-434C-B9D1-6EFA4C69A0CF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execute arbitrary code by sending a specially crafted file to the product's certain management console."}, {"lang": "es", "value": "La vulnerabilidad de funcionalidad oculta en LAN-WH300N/RE todas las versiones proporcionadas por LOGITEC CORPORATION permite a un atacante no autenticado ejecutar c\u00f3digo arbitrario enviando un archivo especialmente dise\u00f1ado a la consola de gesti\u00f3n determinada del producto.\n"}], "id": "CVE-2023-39445", "lastModified": "2023-08-24T18:30:33.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-18T10:15:12.037", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/vu/JVNVU91630351/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20230810-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}