CVE-2021-20855

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the web interface of ELECOM LAN routers WRH-733GBK and WRH-733GWH running firmware versions v1.02.9 and earlier [1]. The vulnerability allows an authenticated attacker to inject arbitrary script via unspecified vectors [1].

Exploitation

An attacker must have valid credentials to the router's administrative web interface. The exact input fields or parameters that are vulnerable are not disclosed in the available references [1]. Once authenticated, the attacker can inject a malicious script that will be executed in the context of the victim's browser when the page is viewed [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any user who accesses the affected router's web interface. This can lead to information disclosure, session hijacking, or other client-side attacks [1].

Mitigation

The available references do not specify a fixed firmware version or workaround for this vulnerability [1]. Users should monitor the vendor's support page for updates and consider restricting access to the router's management interface to trusted networks only.