CVE-2021-20853

Vulnerability

An OS command injection vulnerability (CWE-78) exists in ELECOM LAN routers WRH-733GBK and WRH-733GWH running firmware versions v1.02.9 and earlier. The flaw allows an attacker with administrator privileges to inject arbitrary OS commands through unspecified vectors in the router's management interface [1].

Exploitation

An attacker must be network-adjacent (on the same local network) and possess valid administrator credentials for the router. No user interaction is required. The attacker sends crafted input to the management interface, which is then executed as OS commands with root privileges [1].

Impact

Successful exploitation enables the attacker to execute arbitrary OS commands on the router, leading to full compromise of the device. This results in loss of confidentiality, integrity, and availability of the router and potentially the network it manages [1].

Mitigation

The vendor has released firmware version v1.02.10 to address this vulnerability. Users should update their routers to the latest firmware. No workarounds are documented, and the CVE is not listed in the Known Exploited Vulnerabilities catalog [1].