Katsuhiko Sato

The issue concerns an active debug code vulnerability. If a user with knowledge of the debug function logs in, they may utilize the debug function to execute arbitrary OS commands.

Name of the Vulnerable Software and Affected Versions: FutureNet NXR series, VXR series and WXR series (affected versions not specified) Description: The issue is related to the insecure initialization of a resource in the Telnet service of the affected devices, allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. This vulnerability enables a remote unauthenticated attacker to access the Telnet service without limitations. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows an attacker who has obtained high privileges to execute arbitrary scripts.

The issue is related to improper access control, allowing an attacker to obtain device information via the internet.

The issue allows an attacker to execute an arbitrary OS command via the internet due to the use of a hard-coded password.

The issue is related to an improper authentication vulnerability that allows an attacker to execute an arbitrary command with root privilege via the internet.

The issue is related to inadequate encryption strength in multiple routers, allowing a network-adjacent unauthenticated attacker to guess the encryption key used for wireless LAN communication and intercept the communication.

The issue allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication when the affected product performs the communication without changing the pre-shared key from the factory-default configuration. This occurs due to the use of default credentials vulnerability in the firmware.

An OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command that is not intended to be executed from the web interface by sending a specially crafted request. The affected devices are running in ST (Standalone) mode.

The issue is related to an authentication bypass vulnerability in Fujitsu network devices, specifically the Si-R series and SR-M series. This vulnerability allows a network-adjacent unauthenticated attacker to obtain, change, and/or reset configuration settings of the affected products. The vulnerability is associated with weaknesses in the authentication procedure, which can be exploited by a remote attacker to bypass the authentication process.

The issue is related to improper access control in ELECOM LAN routers, allowing a network-adjacent authenticated attacker to bypass access restrictions and access the management screen of the product via unspecified vectors.

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 versions 1.25 and prior ELECOM WRC-1167GST2A versions 1.25 and prior ELECOM WRC-1167GST2H versions 1.25 and prior ELECOM WRC-2533GS2-B versions 1.52 and prior ELECOM WRC-2533GS2-W versions 1.52 and prior ELECOM WRC-1750GS versions 1.03 and prior ELECOM WRC-1750GSV versions 2.11 and prior ELECOM WRC-1900GST versions 1.03 and prior ELECOM WRC-2533GST versions 1.03 and prior ELECOM WRC-2533GSTA versions 1.03 and prior ELECOM WRC-2533GST2 versions 1.25 and prior ELECOM WRC-2533GST2SP versions 1.25 and prior ELECOM WRC-2533GST2-G versions 1.25 and prior ELECOM EDWRC-2533GST2 versions 1.25 and prior Description: The issue allows a network-adjacent authenticated attacker to execute an arbitrary OS command with the root privilege via unspecified vectors. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 firmware versions 1.25 and prior ELECOM WRC-1167GST2A firmware versions 1.25 and prior ELECOM WRC-1167GST2H firmware versions 1.25 and prior ELECOM WRC-2533GS2-B firmware versions 1.52 and prior ELECOM WRC-2533GS2-W firmware versions 1.52 and prior ELECOM WRC-1750GS firmware versions 1.03 and prior ELECOM WRC-1750GSV firmware versions 2.11 and prior ELECOM WRC-1900GST firmware versions 1.03 and prior ELECOM WRC-2533GST firmware versions 1.03 and prior ELECOM WRC-2533GSTA firmware versions 1.03 and prior ELECOM WRC-2533GST2 firmware versions 1.25 and prior ELECOM WRC-2533GST2SP firmware versions 1.25 and prior ELECOM WRC-2533GST2-G firmware versions 1.25 and prior ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior Description: The issue is related to improper access control in ELECOM routers, allowing a network-adjacent unauthenticated attacker to bypass access restrictions. This enables the attacker to obtain anti-CSRF tokens and change the product's settings via unspecified vectors. Recommendations: For ELECOM WRC-1167GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2A firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2H firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GS2-B firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-2533GS2-W firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-1750GS firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-1750GSV firmware versions 2.11 and prior, update to a version later than 2.11. For ELECOM WRC-1900GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GSTA firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2SP firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2-G firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25.

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-1167GST2 firmware versions 1.25 and prior ELECOM WRC-1167GST2A firmware versions 1.25 and prior ELECOM WRC-1167GST2H firmware versions 1.25 and prior ELECOM WRC-2533GS2-B firmware versions 1.52 and prior ELECOM WRC-2533GS2-W firmware versions 1.52 and prior ELECOM WRC-1750GS firmware versions 1.03 and prior ELECOM WRC-1750GSV firmware versions 2.11 and prior ELECOM WRC-1900GST firmware versions 1.03 and prior ELECOM WRC-2533GST firmware versions 1.03 and prior ELECOM WRC-2533GSTA firmware versions 1.03 and prior ELECOM WRC-2533GST2 firmware versions 1.25 and prior ELECOM WRC-2533GST2SP firmware versions 1.25 and prior ELECOM WRC-2533GST2-G firmware versions 1.25 and prior ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior Description: The issue is related to improper access control in ELECOM routers, allowing a network-adjacent unauthenticated attacker to bypass access restrictions. This enables the attacker to start the telnet service and execute arbitrary OS commands via unspecified vectors. Recommendations: For ELECOM WRC-1167GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2A firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-1167GST2H firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GS2-B firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-2533GS2-W firmware versions 1.52 and prior, update to a version later than 1.52. For ELECOM WRC-1750GS firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-1750GSV firmware versions 2.11 and prior, update to a version later than 2.11. For ELECOM WRC-1900GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GSTA firmware versions 1.03 and prior, update to a version later than 1.03. For ELECOM WRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2SP firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM WRC-2533GST2-G firmware versions 1.25 and prior, update to a version later than 1.25. For ELECOM EDWRC-2533GST2 firmware versions 1.25 and prior, update to a version later than 1.25.

Name of the Vulnerable Software and Affected Versions: WRC-300FEBK versions all WRC-F300NF versions all WRC-733FEBK versions all WRH-300RD versions all WRH-300BK versions all WRH-300SV versions all WRH-300WH versions all WRH-H300WH versions all WRH-H300BK versions all WRH-300BK-S versions all WRH-300WH-S versions all Description: The issue allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors. Recommendations: For all versions of WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S, at the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions Description: The issue allows an unauthenticated network-adjacent attacker to obtain sensitive information via unspecified vectors. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows an attacker on the same network segment to execute arbitrary OS commands with root privilege via unspecified vectors.

The issue allows authenticated attackers to execute arbitrary OS commands via the Command Line Interface (CLI). This is due to the lack of measures to neutralize special elements used in the OS command. Exploitation of the issue may allow a remote attacker to execute arbitrary OS commands.

The issue is related to the lack of measures to neutralize special elements used in operating system commands, which can be exploited by a remote attacker to execute arbitrary commands via the Web User Interface.

The issue allows remote attackers to obtain sensitive information via a crafted application due to improper implementation of the WebView class.