#VU83490 Inadequate Encryption Strength in ELECOM CO. ,LTD. products - CVE-2023-43757


Vulnerability identifier: #VU83490

Vulnerability risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-43757

CWE-ID: CWE-326

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
WRC-2533GHBK2-T
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-2533GHBK-I
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-1750GHBK2-I
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-1750GHBK-E
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-1750GHBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-1167GHBK2
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-1167GHBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-733GHBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-733GHBK-I
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-733GHBK-C
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-300GHBK2-I
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-300GHBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-733FEBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-300FEBK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRC-F300NF
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300WH-H
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300BK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300WH
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300RD
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300SV
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300BK-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300WH-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300BK2-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-300WH2-S
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-H300BK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-H300WH
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-150BK
Hardware solutions / Routers & switches, VoIP, GSM, etc
WRH-150WH
Hardware solutions / Routers & switches, VoIP, GSM, etc
LAN-W300N/RS
Hardware solutions / Routers & switches, VoIP, GSM, etc
LAN-W301NR
Hardware solutions / Routers & switches, VoIP, GSM, etc
LAN-W300N/P
Hardware solutions / Routers & switches, VoIP, GSM, etc
LAN-WH300N/DGP
Hardware solutions / Routers & switches, VoIP, GSM, etc
LAN-WH300NDGPE
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor: ELECOM CO. ,LTD.

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to inadequate encryption strength. A remote attacker on the local network can guess the encryption key used for the wireless LAN communication and intercept the communication.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

WRC-2533GHBK2-T: All versions

WRC-2533GHBK-I: All versions

WRC-1750GHBK2-I: All versions

WRC-1750GHBK-E: All versions

WRC-1750GHBK: All versions

WRC-1167GHBK2: All versions

WRC-1167GHBK: All versions

WRC-733GHBK: All versions

WRC-733GHBK-I: All versions

WRC-733GHBK-C: All versions

WRC-300GHBK2-I: All versions

WRC-300GHBK: All versions

WRC-733FEBK: All versions

WRC-300FEBK: All versions

WRC-F300NF: All versions

WRH-300WH-H: All versions

WRH-300BK: All versions

WRH-300WH: All versions

WRH-300RD: All versions

WRH-300SV: All versions

WRH-300BK-S: All versions

WRH-300WH-S: All versions

WRH-300BK2-S: All versions

WRH-300WH2-S: All versions

WRH-H300BK: All versions

WRH-H300WH: All versions

WRH-150BK: All versions

WRH-150WH: All versions

LAN-W300N/RS: All versions

LAN-W301NR: All versions

LAN-W300N/P: All versions

LAN-WH300N/DGP: All versions

LAN-WH300NDGPE: All versions

External links
https://www.elecom.co.jp/news/security/20231114-01/
https://www.elecom.co.jp/news/security/20230810-01/
https://www.elecom.co.jp/news/security/20210706-01/
https://jvn.jp/en/vu/JVNVU94119876/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Inadequate Encryption Strength in ELECOM routers