CVE-2024-21798

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-28 · updated 2026-06-17
Weakness: CWE-79

Description

ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".

Affected products

Elecom Wmc-X1800Gst-B Firmware: before 1.42 — fixed in 1.42
Elecom Wrc-1167Gs2-B Firmware: before 1.73 — fixed in 1.73
Elecom Wrc-1167Gs2H-B Firmware: before 1.73 — fixed in 1.73
Elecom Wrc-1167Gst2 Firmware: before 1.34 — fixed in 1.34
Elecom Wrc-2533Gs2-B Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gs2-W Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gs2V-B Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gst2 Firmware: before 1.31 — fixed in 1.31
Elecom Wrc-G01-W Firmware: before 1.26 — fixed in 1.26
Elecom Wrc-X3200Gst3-B Firmware: before 1.27 — fixed in 1.27

How to fix

Upgrade to a fixed version: Elecom Wmc-X1800Gst-B Firmware 1.42; Elecom Wrc-1167Gs2-B Firmware 1.73; Elecom Wrc-1167Gs2H-B Firmware 1.73; Elecom Wrc-1167Gst2 Firmware 1.34; Elecom Wrc-2533Gs2-B Firmware 1.68; Elecom Wrc-2533Gs2-W Firmware 1.68; Elecom Wrc-2533Gs2V-B Firmware 1.68; Elecom Wrc-2533Gst2 Firmware 1.31; Elecom Wrc-G01-W Firmware 1.26; Elecom Wrc-X3200Gst3-B Firmware 1.27. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21798 or the next vulnerability affects your stack