CVE-2024-23910

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-28 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attacker to hijack the authentication of administrators and to perform unintended operations to the affected product. Note that WMC-X1800GST-B and WSC-X1800GS-B are also included in e-Mesh Starter Kit "WMC-2LX-B".

Affected products

Elecom Wmc-X1800Gst-B Firmware: before 1.42 — fixed in 1.42
Elecom Wrc-1167Gs2-B Firmware: before 1.73 — fixed in 1.73
Elecom Wrc-1167Gs2H-B Firmware: before 1.73 — fixed in 1.73
Elecom Wrc-1167Gst2 Firmware: before 1.34 — fixed in 1.34
Elecom Wrc-2533Gs2-B Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gs2-W Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gs2V-B Firmware: before 1.68 — fixed in 1.68
Elecom Wrc-2533Gst2 Firmware: before 1.31 — fixed in 1.31
Elecom Wrc-G01-W Firmware: before 1.26 — fixed in 1.26
Elecom Wrc-X3200Gst3-B Firmware: before 1.27 — fixed in 1.27
Elecom Wsc-X1800Gs-B Firmware: before 1.42 — fixed in 1.42

How to fix

Upgrade to a fixed version: Elecom Wmc-X1800Gst-B Firmware 1.42; Elecom Wrc-1167Gs2-B Firmware 1.73; Elecom Wrc-1167Gs2H-B Firmware 1.73; Elecom Wrc-1167Gst2 Firmware 1.34; Elecom Wrc-2533Gs2-B Firmware 1.68; Elecom Wrc-2533Gs2-W Firmware 1.68; Elecom Wrc-2533Gs2V-B Firmware 1.68; Elecom Wrc-2533Gst2 Firmware 1.31; Elecom Wrc-G01-W Firmware 1.26; Elecom Wrc-X3200Gst3-B Firmware 1.27; Elecom Wsc-X1800Gs-B Firmware 1.42. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-23910 or the next vulnerability affects your stack