CVE-2021-20856

Vulnerability

A cross-site scripting (XSS) vulnerability exists in ELECOM LAN routers WRH-733GBK and WRH-733GWH running firmware versions v1.02.9 and prior. The vulnerability allows an attacker to inject arbitrary scripts via unspecified vectors. The affected models are limited to these two devices with the specified firmware versions [1].

Exploitation

An attacker must be authenticated to the router's management interface. The exact vectors are not disclosed, but the attacker can inject a malicious script that will be executed in the context of the router's web interface. No user interaction beyond the attacker's own authentication is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the router's web interface. This could lead to session hijacking, defacement, or theft of sensitive information displayed on the management pages. The impact is limited to the authenticated session of the victim user.

Mitigation

As of the publication date (2021-12-01), no fixed firmware version has been disclosed in the available references. Users should monitor the vendor's support page for updates. No workaround is provided. The affected devices are not listed on the CISA KEV.