CVE-2023-37561 Open redirect in WRH-300WH-H
Remote attackers can redirect users to malicious sites via crafted URLs, enabling phishing attacks on ELECOM wireless routers and repeaters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-37561?
CVE-2023-37561 is a medium-severity vulnerability in ELECOM CO.,LTD. WRH-300WH-H, published on 13 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect vulnerability in ELECOM wireless LAN routers and ELECOM wireless LAN repeaters allows a remote unauthenticated attacker to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted URL. Affected products and versions are as follows: WRH-300WH-H v2.12 and earlier, WTC-300HWH v1.09 and earlier, WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier.
Weakness: CWE-601
Which versions are affected by CVE-2023-37561?
It affects 4 products.
Products include Elecom Wrh-300wh-H Firmware, Elecom Wtc-300hwh Firmware, Elecom Wtc-C1167gc-B Firmware, Elecom Wtc-C1167gc-W Firmware.
How do I fix CVE-2023-37561?
No fix has been published for CVE-2023-37561 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-37561 being exploited?
There is no known exploitation of CVE-2023-37561 in the wild and no public exploit code.
Other vulnerabilities in ELECOM CO.,LTD. WRH-300WH-H
Sources
Also known as GHSA-gfq6-w9c5-675j.