CVE-2024-40883

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-01 · updated 2026-06-17
Weakness: CWE-352

Description

Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc.

Affected products

Elecom Wrc-2533Gs2-B Firmware: before 1.69 — fixed in 1.69
Elecom Wrc-2533Gs2-W Firmware: before 1.69 — fixed in 1.69
Elecom Wrc-2533Gs2V-B Firmware: before 1.69 — fixed in 1.69
Elecom Wrc-X1500Gs-B Firmware: before 1.12 — fixed in 1.12
Elecom Wrc-X1500Gsa-B Firmware: before 1.12 — fixed in 1.12
Elecom Wrc-X6000Xs-G Firmware: before 1.12 — fixed in 1.12

How to fix

Upgrade to a fixed version: Elecom Wrc-2533Gs2-B Firmware 1.69; Elecom Wrc-2533Gs2-W Firmware 1.69; Elecom Wrc-2533Gs2V-B Firmware 1.69; Elecom Wrc-X1500Gs-B Firmware 1.12; Elecom Wrc-X1500Gsa-B Firmware 1.12; Elecom Wrc-X6000Xs-G Firmware 1.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-40883 or the next vulnerability affects your stack