CVE-2023-40072
moderate-risk
Published 2023-08-18
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
Do I need to act?
~
2.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (2)
Wab-S600-Ps Firmware
Wab-S300 Firmware
Affected Vendors
References (6)
Third Party Advisory
https://jvn.jp/en/vu/JVNVU91630351/
Vendor Advisory
https://www.elecom.co.jp/news/security/20230810-01/
Third Party Advisory
https://jvn.jp/en/vu/JVNVU91630351/
Vendor Advisory
https://www.elecom.co.jp/news/security/20230810-01/
43
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
6/34 · Minimal
Exposure
7/34 · Low