Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2021-20739: WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attack...
CVE-2021-20739 · published 5 years ago
Summary
WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| elecom | wrc-300febk_firmware |
All versions
cpe:2.3:o:elecom:wrc-300febk_firmware:*:*:*:*:*:*:*:* |
| elecom | wrc-f300nf_firmware |
All versions
cpe:2.3:o:elecom:wrc-f300nf_firmware:*:*:*:*:*:*:*:* |
| elecom | wrc-733febk_firmware |
All versions
cpe:2.3:o:elecom:wrc-733febk_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300rd_firmware |
All versions
cpe:2.3:o:elecom:wrh-300rd_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300bk_firmware |
All versions
cpe:2.3:o:elecom:wrh-300bk_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300sv_firmware |
All versions
cpe:2.3:o:elecom:wrh-300sv_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300wh_firmware |
All versions
cpe:2.3:o:elecom:wrh-300wh_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-h300wh_firmware |
All versions
cpe:2.3:o:elecom:wrh-h300wh_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-h300bk_firmware |
All versions
cpe:2.3:o:elecom:wrh-h300bk_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300bk-s_firmware |
All versions
cpe:2.3:o:elecom:wrh-300bk-s_firmware:*:*:*:*:*:*:*:* |
| elecom | wrh-300wh-s_firmware |
All versions
cpe:2.3:o:elecom:wrh-300wh-s_firmware:*:*:*:*:*:*:*:* |
Original advisory text
WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attack...
WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors.
References
- https://jvn.jp/en/vu/JVNVU94260088/index.html Third Party Advisory
- https://www.elecom.co.jp/news/security/20210706-01/ Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published7 Jul 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-20739 · NVD
Track software like this
Free during beta