High · 8.8 CVE-2023-40072 EUVD-2023-44679GHSA-c3w7-xm4j-hrp8

OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS comm…

Published Aug 18, 2023 · Updated Jul 3, 2025 · Assigned by jpcert

Vendor: ELECOM Product: WAB-I1750-PS Product: WAB-M1775-PS Product: WAB-M2133 Product: WAB-S1167 Product: WAB-S1167-PS Product: WAB-S1775 Product: WAB-S300 Product: WAB-S600-PS

Description

OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.

Affected products

Vendor	Product	Affected	Fixed
ELECOM	WAB-S600-PS	all versions	—
ELECOM	WAB-S300	all versions	—
ELECOM	WAB-S1775	v1.1.9 and earlier	—
ELECOM	WAB-M1775-PS	v1.1.21 and earlier	—
ELECOM	WAB-S1167	v1.0.7 and earlier	—
ELECOM	WAB-M2133	v1.3.22 and earlier	—
ELECOM	WAB-I1750-PS	v1.5.10 and earlier	—
ELECOM	WAB-S1167-PS	v1.5.6 and earlier	—

References

https://www.elecom.co.jp/news/security/20231114-01/
https://www.elecom.co.jp/news/security/20230810-01/
https://jvn.jp/en/vu/JVNVU91630351/