CVE-2020-5634 - OpenCVE

ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:A/AC:L/Au:N/C:C/I:C/A:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Elecom	Wrc-1167gst2 Wrc-1167gst2 Firmware Wrc-1750gst2 Wrc-1750gst2 Firmware Wrc-1900gst2 Wrc-1900gst2 Firmware Wrc-2533gst2 Wrc-2533gst2 Firmware

Configuration 1 [-]

AND

cpe:2.3:h:elecom:wrc-2533gst2:-:*:*:*:*:*:*:*

cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:h:elecom:wrc-1900gst2:-:*:*:*:*:*:*:*

cpe:2.3:o:elecom:wrc-1900gst2_firmware:*:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:h:elecom:wrc-1750gst2:-:*:*:*:*:*:*:*

cpe:2.3:o:elecom:wrc-1750gst2_firmware:*:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:h:elecom:wrc-1167gst2:-:*:*:*:*:*:*:*

cpe:2.3:o:elecom:wrc-1167gst2_firmware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/en/jp/JVN82892096/index.html
https://www.elecom.co.jp/news/security/20201005-01/

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2020-10-06T05:00:27

Updated: 2024-08-04T08:39:25.452Z

Reserved: 2020-01-06T00:00:00

Link: CVE-2020-5634

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-10-06T06:15:12.653

Modified: 2020-10-13T17:33:21.393

Link: CVE-2020-5634

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "ELECOM LAN routers", "vendor": "ELECOM CO.,LTD.", "versions": [{"status": "affected", "version": "WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10"}]}], "descriptions": [{"lang": "en", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "OS Command Injection", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-10-06T05:00:27", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.elecom.co.jp/news/security/20201005-01/"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2020-5634", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ELECOM LAN routers", "version": {"version_data": [{"version_value": "WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10"}]}}]}, "vendor_name": "ELECOM CO.,LTD."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "OS Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.elecom.co.jp/news/security/20201005-01/", "refsource": "MISC", "url": "https://www.elecom.co.jp/news/security/20201005-01/"}, {"name": "https://jvn.jp/en/jp/JVN82892096/index.html", "refsource": "MISC", "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T08:39:25.452Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.elecom.co.jp/news/security/20201005-01/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2020-5634", "datePublished": "2020-10-06T05:00:27", "dateReserved": "2020-01-06T00:00:00", "dateUpdated": "2024-08-04T08:39:25.452Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-2533gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "85BF0A23-43C9-4497-BDDF-9366642503ED", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-2533gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADE64129-08D1-44B4-ACEE-2A6430AD57F3", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1900gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "44AEB29B-9370-4C4A-8CEF-A1127FB48682", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1900gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8F9BF39B-5EF4-49B3-8C4D-52065361A653", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1750gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "BD054832-3D35-40BF-B9DB-D0AC6C8AB000", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1750gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "07BB2AC6-C2ED-4EBD-BE4B-CB7528DDCA3F", "versionEndExcluding": "1.14", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-1167gst2:-:*:*:*:*:*:*:*", "matchCriteriaId": "F9045F74-985E-4C3C-AC10-14FD9B61A746", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-1167gst2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F07994E-A952-40E2-8C78-AA5FD1794E5F", "versionEndExcluding": "1.10", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ELECOM LAN routers (WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10) allow an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecified vectors."}, {"lang": "es", "value": "Los enrutadores LAN ELECOM (versiones de firmware WRC-2533GST2 anteriores a v1.14, versiones de firmware WRC-1900GST2 anteriores a v1.14, versiones de firmware WRC-1750GST2 anteriores a v1.14 y versiones de firmware WRC-1167GST2 anteriores a v1.10), permite a un atacante en el mismo segmento de red ejecutar comandos arbitrarios de Sistema Operativo con un privilegio root por medio de vectores no especificados"}], "id": "CVE-2020-5634", "lastModified": "2020-10-13T17:33:21.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 8.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-10-06T06:15:12.653", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN82892096/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20201005-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}