CVE-2024-34577 - Vulnerability Details

Vendors	Products
Elecom	Wrc-x3000gs2-b Wrc-x3000gs2-b Firmware Wrc-x3000gs2-w Wrc-x3000gs2-w Firmware Wrc-x3000gs2a-b Wrc-x3000gs2a-b Firmware

Link	Providers
https://jvn.jp/en/jp/JVN24885537/
https://www.elecom.co.jp/news/security/20240827-01/

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`	cvssV3_1 `{'score': 4.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Elecom Elecom wrc-x3000gs2-b Elecom wrc-x3000gs2-b Firmware Elecom wrc-x3000gs2-w Elecom wrc-x3000gs2-w Firmware Elecom wrc-x3000gs2a-b Elecom wrc-x3000gs2a-b Firmware
Weaknesses		CWE-79
CPEs		cpe:2.3:h:elecom:wrc-x3000gs2-b:-:::::::* cpe:2.3:h:elecom:wrc-x3000gs2-w:-:::::::* cpe:2.3:h:elecom:wrc-x3000gs2a-b:-:::::::* cpe:2.3:o:elecom:wrc-x3000gs2-b_firmware:::::::: cpe:2.3:o:elecom:wrc-x3000gs2-w_firmware:::::::: cpe:2.3:o:elecom:wrc-x3000gs2a-b_firmware::::::::
Vendors & Products		Elecom Elecom wrc-x3000gs2-b Elecom wrc-x3000gs2-b Firmware Elecom wrc-x3000gs2-w Elecom wrc-x3000gs2-w Firmware Elecom wrc-x3000gs2a-b Elecom wrc-x3000gs2a-b Firmware
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.
References		https://jvn.jp/en/jp/JVN24885537/ https://www.elecom.co.jp/news/security/20240827-01/

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34577", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-08-16T04:42:10.924Z", "datePublished": "2024-08-30T06:29:32.671Z", "dateUpdated": "2025-03-13T16:11:44.120Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser."}], "problemTypes": [{"descriptions": [{"description": "Cross-site scripting (XSS)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20240827-01/"}, {"url": "https://jvn.jp/en/jp/JVN24885537/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-08-30T06:29:32.671Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-30T14:24:29.112981Z", "id": "CVE-2024-34577", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-13T16:11:44.120Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-34577 (string)

assignerOrgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

state : PUBLISHED (string)

assignerShortName : jpcert (string)

dateReserved : 2024-08-16T04:42:10.924Z (string)

datePublished : 2024-08-30T06:29:32.671Z (string)

dateUpdated : 2025-03-13T16:11:44.120Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2-B (string)

versions : [ »

0 : { »

version : v1.08 and earlier (string)

status : affected (string)

}

]

}

1 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2-W (string)

versions : [ »

0 : { »

version : v1.08 and earlier (string)

status : affected (string)

}

]

}

2 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2A-B (string)

versions : [ »

0 : { »

version : v1.08 and earlier (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Cross-site scripting (XSS) (string)

lang : en (string)

type : text (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.elecom.co.jp/news/security/20240827-01/ (string)

}

1 : { »

url : https://jvn.jp/en/jp/JVN24885537/ (string)

}

]

providerMetadata : { »

orgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

shortName : jpcert (string)

dateUpdated : 2024-08-30T06:29:32.671Z (string)

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-79 (string)

lang : en (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.6 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-30T14:24:29.112981Z (string)

id : CVE-2024-34577 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-13T16:11:44.120Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-30T14:24:29.112981Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-30T14:24:33.837Z"}}], "cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20240827-01/"}, {"url": "https://jvn.jp/en/jp/JVN24885537/"}], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Cross-site scripting (XSS)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-08-30T06:29:32.671Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34577", "state": "PUBLISHED", "dateUpdated": "2025-03-13T16:11:44.120Z", "dateReserved": "2024-08-16T04:42:10.924Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-08-30T06:29:32.671Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.6 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : LOW (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-34577 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-30T14:24:29.112981Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-30T14:24:33.837Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2-B (string)

versions : [ »

0 : { »

status : affected (string)

version : v1.08 and earlier (string)

}

]

}

1 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2-W (string)

versions : [ »

0 : { »

status : affected (string)

version : v1.08 and earlier (string)

}

]

}

2 : { »

vendor : ELECOM CO.,LTD. (string)

product : WRC-X3000GS2A-B (string)

versions : [ »

0 : { »

status : affected (string)

version : v1.08 and earlier (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.elecom.co.jp/news/security/20240827-01/ (string)

}

1 : { »

url : https://jvn.jp/en/jp/JVN24885537/ (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Cross-site scripting (XSS) (string)

}

]

}

]

providerMetadata : { »

orgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

shortName : jpcert (string)

dateUpdated : 2024-08-30T06:29:32.671Z (string)

}

cveMetadata : { »

cveId : CVE-2024-34577 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-13T16:11:44.120Z (string)

dateReserved : 2024-08-16T04:42:10.924Z (string)

assignerOrgId : ede6fdc4-6654-4307-a26d-3331c018e2ce (string)

datePublished : 2024-08-30T06:29:32.671Z (string)

assignerShortName : jpcert (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x3000gs2-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D125A4ED-8AB6-4A49-A806-A9FC65455669", "versionEndIncluding": "1.08", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x3000gs2-b:-:*:*:*:*:*:*:*", "matchCriteriaId": "6D748C9E-0B14-404C-A0D7-4DD1DDF35C11", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x3000gs2-w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1D0B1E8-3E29-40F0-8E71-CC7B89BF8572", "versionEndIncluding": "1.08", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x3000gs2-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "70A7409C-3E07-4A7B-8248-F2090A74448B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x3000gs2a-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "09A8CB6C-57A5-4B67-A128-4ACCEDB19B85", "versionEndIncluding": "1.08", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x3000gs2a-b:-:*:*:*:*:*:*:*", "matchCriteriaId": "E2DC2AA9-297E-4FAC-B64D-64A06ED4ED1F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross Site Scripting en WRC-X3000GS2-B, WRC-X3000GS2-W y WRC-X3000GS2A-B debido al procesamiento incorrecto de los valores de entrada en easysetup.cgi. Si un usuario visualiza una p\u00e1gina web maliciosa mientras est\u00e1 conectado al producto, es posible que se ejecute una secuencia de comandos arbitraria en el navegador web del usuario."}], "id": "CVE-2024-34577", "lastModified": "2025-03-13T17:15:31.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-30T07:15:11.660", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN24885537/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20240827-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:elecom:wrc-x3000gs2-b_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D125A4ED-8AB6-4A49-A806-A9FC65455669 (string)

versionEndIncluding : 1.08 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:elecom:wrc-x3000gs2-b:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 6D748C9E-0B14-404C-A0D7-4DD1DDF35C11 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:elecom:wrc-x3000gs2-w_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : B1D0B1E8-3E29-40F0-8E71-CC7B89BF8572 (string)

versionEndIncluding : 1.08 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:elecom:wrc-x3000gs2-w:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 70A7409C-3E07-4A7B-8248-F2090A74448B (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:elecom:wrc-x3000gs2a-b_firmware:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 09A8CB6C-57A5-4B67-A128-4ACCEDB19B85 (string)

versionEndIncluding : 1.08 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:h:elecom:wrc-x3000gs2a-b:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E2DC2AA9-297E-4FAC-B64D-64A06ED4ED1F (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. (string)

}

1 : { »

lang : es (string)

value : Existe una vulnerabilidad de Cross Site Scripting en WRC-X3000GS2-B, WRC-X3000GS2-W y WRC-X3000GS2A-B debido al procesamiento incorrecto de los valores de entrada en easysetup.cgi. Si un usuario visualiza una página web maliciosa mientras está conectado al producto, es posible que se ejecute una secuencia de comandos arbitraria en el navegador web del usuario. (string)

}

]

id : CVE-2024-34577 (string)

lastModified : 2025-03-13T17:15:31.653 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.6 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.1 (number)

impactScore : 2.5 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-08-30T07:15:11.660 (string)

references : [ »

0 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://jvn.jp/en/jp/JVN24885537/ (string)

}

1 : { »

source : vultures@jpcert.or.jp (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.elecom.co.jp/news/security/20240827-01/ (string)

}

]

sourceIdentifier : vultures@jpcert.or.jp (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object