Vulnerabilidades em ELECOM CO.,LTD.
84 resultadosAnálise Vexday
Com 81 CVEs catalogadas e nenhuma confirmação de exploração ativa no catálogo KEV da CISA, o perfil de risco imediato dos produtos ELECOM CO.,LTD. situa-se abaixo da média geral do catálogo. A falha mais comum é CWE-78 (OS Command Injection), categoria que historicamente oferece primitivas de execução remota de comandos e merece atenção prioritária em ambientes expostos à rede. Das 81 vulnerabilidades, 6 são classificadas como críticas e 7 surgiram nos últimos 90 dias, indicando ritmo contínuo de descoberta; a CVE mais perigosa atualmente rastreada é CVE-2025-43879, com EPSS de 0,0263, o que sugere probabilidade ainda moderada de exploração em curto prazo. A ausência de PoCs públicas conhecidas reduz a exposição imediata, mas não elimina o risco, especialmente dado o padrão de injeção de comandos prevalente no portfólio.
CVE-2023-37565—Code injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute arbitrary code by seEPSS 0.5%CVE-2021-20646—Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administratoEPSS 0.5%CVE-2021-20647—Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administratoEPSS 0.5%CVE-2021-20650—Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administraEPSS 0.5%CVE-2021-20739—WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all vEPSS 0.5%CVE-2021-20864—Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-EPSS 0.5%CVE-2023-37560—Cross-site scripting vulnerability in WRH-300WH-H v2.12 and earlier, and WTC-300HWH v1.09 and earlier allows a remote unauthenticated attackEPSS 0.5%CVE-2023-43757—Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjaceEPSS 0.5%CVE-2026-40621CRITICALELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated wiEPSS 0.5%CVE-2023-37561—Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redEPSS 0.5%CVE-2024-39300HIGHMissing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is eEPSS 0.5%CVE-2021-20648—ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors.EPSS 0.5%CVE-2021-20852—Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allowsEPSS 0.5%CVE-2022-21173—Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-EPSS 0.4%CVE-2021-20861—Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, EPSS 0.4%CVE-2022-25915—Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, EPSS 0.4%CVE-2023-37568—ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated atEPSS 0.4%CVE-2021-20854—ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker withEPSS 0.4%CVE-2021-20853—ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker withEPSS 0.4%CVE-2021-20738—WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information EPSS 0.4%