ELECOM WRC-1167GHBK2-S Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the ELECOM WRC-1167GHBK2-S wireless LAN router, all versions. This vulnerability allows an authenticated attacker to execute arbitrary scripts in the web browser of users accessing the router's WebGUI.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary scripts in the web browser of the user accessing the router's WebGUI.

Remediation

ELECOM has stated that this product is no longer supported and recommends users stop using it. As a temporary measure, users can change the WebGUI login password, avoid accessing other websites while logged into the WebGUI, close the web browser after finishing with the WebGUI, and delete the stored WebGUI password from the browser.