CVE-2021-20739 Command injection in WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S
Unauthenticated network-adjacent attackers can execute arbitrary OS commands on ELECOM wireless routers, potentially compromising the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20739?
CVE-2021-20739 is a high-severity command injection vulnerability in ELECOM CO.,LTD. WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S, published on 7 Jul 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors.
Weakness: CWE-78
Which versions are affected by CVE-2021-20739?
It affects 11 products.
Products include Elecom Wrc-300febk Firmware, Elecom Wrc-733febk Firmware, Elecom Wrc-F300nf Firmware, Elecom Wrh-300bk-S Firmware, Elecom Wrh-300bk Firmware, Elecom Wrh-300rd Firmware and 5 more.
How do I fix CVE-2021-20739?
No fix has been published for CVE-2021-20739 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-20739 being exploited?
There is no known exploitation of CVE-2021-20739 in the wild and no public exploit code.
Sources
Also known as GHSA-6g7g-h77w-72mh.