CVE-2024-25579 in WRC-1167GS2-B
Summary
by MITRE • 02/29/2024
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Note that WMC-X1800GST-B is also included in e-Mesh Starter Kit "WMC-2LX-B".
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/15/2026
This vulnerability represents a critical operating system command injection flaw in ELECOM wireless LAN routers that enables remote code execution through a network-adjacent attacker with administrative privileges. The vulnerability stems from insufficient input validation and sanitization within the router's web interface or API endpoints, allowing maliciously crafted requests to be interpreted as operating system commands rather than legitimate data. The affected devices include the WMC-X1800GST-B model and the e-Mesh Starter Kit component WMC-2LX-B, which are widely deployed in enterprise and small office environments. The flaw exists at the application layer where user-supplied parameters are directly concatenated into system command executions without proper escaping or filtering mechanisms, creating a direct path for command injection attacks.
The technical exploitation of this vulnerability requires an attacker to be within the network perimeter and possess administrative credentials, which significantly reduces the attack surface compared to fully remote exploits. However, the impact remains severe as the successful exploitation allows the attacker to execute arbitrary operating system commands with the highest privileges available on the device. This means the attacker can potentially gain complete control over the router's functionality, modify network configurations, access sensitive data stored on the device, and establish persistent access points for further network infiltration. The vulnerability aligns with CWE-77 and CWE-88 categories, which specifically address command injection flaws where user-controllable data is improperly incorporated into system commands without adequate sanitization. The attack vector follows the ATT&CK framework's T1059.001 technique for command and scripting interpreter, specifically targeting the Windows command shell or Unix shell environments that these routers typically utilize for system operations.
The operational impact of this vulnerability extends beyond immediate device compromise to potentially affect entire network infrastructures. Compromised routers can serve as launching points for lateral movement attacks, allowing attackers to pivot to other network segments and escalate privileges further. Network traffic interception, man-in-the-middle attacks, and DNS hijacking become possible once the router is compromised. The vulnerability also poses significant risks to network availability as attackers can potentially cause denial of service conditions by executing commands that disrupt normal router operations or modify critical network parameters. Organizations using these devices should immediately assess their network segmentation strategies and implement additional monitoring controls to detect anomalous command execution patterns. The exploitation of this vulnerability can lead to data exfiltration, network disruption, and potential compliance violations, particularly in regulated environments where network security controls are mandated. Mitigation strategies should include immediate firmware updates from ELECOM, network segmentation to limit administrative access, implementation of intrusion detection systems, and regular security audits of network infrastructure components.