ELECOM Wireless LAN Access Points Hard-Coded Key Vulnerability Allowing Configuration Tampering

A vulnerability exists in several ELECOM wireless LAN access point models, all running version 1.09 or earlier, as well as in models WRC-BE72XSD-B, WRC-BE72XSD-BA, WRC-BE65QSD-B, and WRC-W702-B, all through version 1.1.1. These devices use a hard-coded cryptographic key for encrypting backup configuration files. An attacker aware of this key could manipulate the configuration file, potentially leading to unauthorized changes when a victim administrator is deceived into using the altered file.

Impact

Exploitation of this vulnerability allows an attacker to tamper with the device's configuration file, creating the possibility for unauthorized changes to be applied, especially if the modified file is used by an administrator.

Remediation

Users are advised to update the firmware to the latest version available for their specific device model.