ELECOM WRH-733GBK and WRH-733GWH OS Command Injection Vulnerability in Telnet Function

A vulnerability allowing OS command injection has been identified in the telnet function of ELECOM wireless LAN routers WRH-733GBK and WRH-733GWH, all versions. This vulnerability allows remote unauthenticated attackers to execute arbitrary OS commands on the affected devices.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected router.

Remediation

ELECOM has announced that these products are no longer supported and recommends users stop using them. For WRC-1167GHBK2-S, a workaround is available by changing the WebGUI login password, avoiding access to other websites while logged into the WebGUI, closing the web browser after using the WebGUI, and deleting the stored WebGUI password from the browser.