Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by s…

published 2023-07-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-41451

cvss: 8.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167FEBK-S v1.04 and earlier, WRC-1167GHBK3-A v1.24 and earlier, and WRC-1167FEBK-A v1.18 and earlier.

Patch / fix

fixed in 5

elecom wrc-1167gebk-s 1.03
elecom wrc-1167febk-s 1.04
elecom wrc-1167ghbk-s 1.03
elecom wrc-1167ghbk3-a 1.24
elecom wrc-1167febk-a 1.18

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-11-07)

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	8.0	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

ELECOM CO.,LTD. WRC-1167GHBK-S
ELECOM CO.,LTD. WRC-1167GEBK-S
ELECOM CO.,LTD. WRC-1167FEBK-S
ELECOM CO.,LTD. WRC-1167GHBK3-A
ELECOM CO.,LTD. WRC-1167FEBK-A
elecom wrc-1167gebk-s
elecom wrc-1167febk-s
elecom wrc-1167ghbk-s
elecom wrc-1167ghbk3-a
elecom wrc-1167febk-a

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

elecom.co.jp /news/security/20230711-01/
vendor-advisory
jvn.jp /en/jp/JVN05223215/
third-party-advisory

Sources

CVE List CVE-2023-37565
NVD CVE-2023-37565

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary