{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-40883", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-07-26T08:52:14.749Z", "datePublished": "2024-08-01T01:18:01.801Z", "dateUpdated": "2024-08-30T06:29:38.304Z"}, "containers": {"cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XS-G", "versions": [{"version": "v1.11 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1500GS-B", "versions": [{"version": "v1.11 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1500GSA-B", "versions": [{"version": "v1.11 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"version": "v1.08 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc."}], "problemTypes": [{"descriptions": [{"description": "Cross-site request forgery (CSRF)", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20240730-01/"}, {"url": "https://jvn.jp/en/jp/JVN06672778/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-08-30T06:29:38.304Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-01T14:24:58.175059Z", "id": "CVE-2024-40883", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T14:25:07.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-40883", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-01T14:24:58.175059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T14:25:05.256Z"}}], "cna": {"affected": [{"vendor": "ELECOM CO.,LTD.", "product": "WRC-X6000XS-G", "versions": [{"status": "affected", "version": "v1.11 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1500GS-B", "versions": [{"status": "affected", "version": "v1.11 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X1500GSA-B", "versions": [{"status": "affected", "version": "v1.11 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-B", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2-W", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}, {"vendor": "ELECOM CO.,LTD.", "product": "WRC-X3000GS2A-B", "versions": [{"status": "affected", "version": "v1.08 and earlier"}]}], "references": [{"url": "https://www.elecom.co.jp/news/security/20240730-01/"}, {"url": "https://jvn.jp/en/jp/JVN06672778/"}], "descriptions": [{"lang": "en", "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Cross-site request forgery (CSRF)"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-08-30T06:29:38.304Z"}}}, "cveMetadata": {"cveId": "CVE-2024-40883", "state": "PUBLISHED", "dateUpdated": "2024-08-30T06:29:38.304Z", "dateReserved": "2024-07-26T08:52:14.749Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2024-08-01T01:18:01.801Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F4C8BB-6DA7-4227-BDE9-3113CEFA110A", "versionEndExcluding": "1.69", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-2533gs2-b:-:*:*:*:*:*:*:*", "matchCriteriaId": "D9FF3CB7-7F2E-472A-A2A3-ED599F4FC99C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "77A56640-4A80-4338-9BBF-901088D26193", "versionEndExcluding": "1.69", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-2533gs2-w:-:*:*:*:*:*:*:*", "matchCriteriaId": "ECD9F0FE-1232-4C39-AA86-2D616E4D39C6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-2533gs2v-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3892264D-1108-432F-83EA-E027A6AA0610", "versionEndExcluding": "1.69", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-2533gs2v-b:-:*:*:*:*:*:*:*", "matchCriteriaId": "69FF2911-A946-4E48-B50A-F1F5EC95BBCC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x6000xs-g_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1309B92-8C27-488A-8190-A164502EE615", "versionEndExcluding": "1.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x6000xs-g:-:*:*:*:*:*:*:*", "matchCriteriaId": "D50F2091-30D4-4A3E-A28A-B9D67D70DB2C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x1500gs-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C34B5CB1-4483-49B0-B281-1F61045785C7", "versionEndExcluding": "1.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x1500gs-b:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2B13224-1E88-4415-8B8E-979D00BD68F2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:elecom:wrc-x1500gsa-b_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "82A4CAE8-0C68-4881-92F3-6BFFD72A58CA", "versionEndExcluding": "1.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:elecom:wrc-x1500gsa-b:*:*:*:*:*:*:*:*", "matchCriteriaId": "D198866F-7CB3-4EA0-86EA-345CF65E116F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc."}, {"lang": "es", "value": " Existe una vulnerabilidad de Cross-site request forgery en los enrutadores LAN inal\u00e1mbricos ELECOM. Al ver una p\u00e1gina maliciosa mientras inicia sesi\u00f3n en el producto afectado con un privilegio administrativo, se puede dirigir al usuario a realizar operaciones no deseadas, como cambiar el ID de inicio de sesi\u00f3n, la contrase\u00f1a de inicio de sesi\u00f3n, etc."}], "id": "CVE-2024-40883", "lastModified": "2024-08-23T16:52:30.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-08-01T02:15:02.023", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN06672778/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.elecom.co.jp/news/security/20240730-01/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}