{"api_version":"1","generated_at":"2026-05-12T11:07:27+00:00","cve":"CVE-2024-34577","urls":{"html":"https://cve.report/CVE-2024-34577","api":"https://cve.report/api/cve/CVE-2024-34577.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-34577","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-34577"},"summary":{"title":"CVE-2024-34577","description":"Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.","state":"PUBLISHED","assigner":"jpcert","published_at":"2024-08-30 07:15:11","updated_at":"2026-05-12 09:16:17"},"problem_types":["CWE-79","CWE-79 Cross-site scripting (XSS)","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"6.1","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"ADP","type":"DECLARED","score":"4.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"4.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}}],"references":[{"url":"https://www.elecom.co.jp/news/security/20240827-01/","name":"https://www.elecom.co.jp/news/security/20240827-01/","refsource":"vultures@jpcert.or.jp","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://jvn.jp/en/jp/JVN24885537/","name":"https://jvn.jp/en/jp/JVN24885537/","refsource":"vultures@jpcert.or.jp","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34577","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34577","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"ELECOM CO.,LTD.","product":"WRC-X3000GS2-B","version":"affected v1.08 and earlier","platforms":[]},{"source":"CNA","vendor":"ELECOM CO.,LTD.","product":"WRC-X3000GS2-W","version":"affected v1.08 and earlier","platforms":[]},{"source":"CNA","vendor":"ELECOM CO.,LTD.","product":"WRC-X3000GS2A-B","version":"affected v1.08 and earlier","platforms":[]},{"source":"CNA","vendor":"ELECOM CO.,LTD.","product":"WRC-X3000GST2-B","version":"affected v1.06 and earlier","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"34577","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"elecom","cpe5":"wrc-x3000gs2-b","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"34577","vulnerable":"1","versionEndIncluding":"1.08","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"elecom","cpe5":"wrc-x3000gs2-b_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"34577","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"elecom","cpe5":"wrc-x3000gs2-w","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"34577","vulnerable":"1","versionEndIncluding":"1.08","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"elecom","cpe5":"wrc-x3000gs2-w_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"34577","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"elecom","cpe5":"wrc-x3000gs2a-b","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2024","cve_id":"34577","vulnerable":"1","versionEndIncluding":"1.08","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"elecom","cpe5":"wrc-x3000gs2a-b_firmware","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}},{"other":{"content":{"id":"CVE-2024-34577","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-08-30T14:24:29.112981Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-03-13T16:11:44.120Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"WRC-X3000GS2-B","vendor":"ELECOM CO.,LTD.","versions":[{"status":"affected","version":"v1.08 and earlier"}]},{"product":"WRC-X3000GS2-W","vendor":"ELECOM CO.,LTD.","versions":[{"status":"affected","version":"v1.08 and earlier"}]},{"product":"WRC-X3000GS2A-B","vendor":"ELECOM CO.,LTD.","versions":[{"status":"affected","version":"v1.08 and earlier"}]},{"product":"WRC-X3000GST2-B","vendor":"ELECOM CO.,LTD.","versions":[{"status":"affected","version":"v1.06 and earlier"}]}],"descriptions":[{"lang":"en","value":"Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Cross-site scripting (XSS)","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-12T08:10:19.352Z","orgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","shortName":"jpcert"},"references":[{"url":"https://www.elecom.co.jp/news/security/20240827-01/"},{"url":"https://jvn.jp/en/jp/JVN24885537/"}]}},"cveMetadata":{"assignerOrgId":"ede6fdc4-6654-4307-a26d-3331c018e2ce","assignerShortName":"jpcert","cveId":"CVE-2024-34577","datePublished":"2024-08-30T06:29:32.671Z","dateReserved":"2024-08-16T04:42:10.924Z","dateUpdated":"2026-05-12T08:10:19.352Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-08-30 07:15:11","lastModifiedDate":"2026-05-12 09:16:17","problem_types":["CWE-79","CWE-79 Cross-site scripting (XSS)","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:elecom:wrc-x3000gs2-b_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.08","matchCriteriaId":"D125A4ED-8AB6-4A49-A806-A9FC65455669"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:elecom:wrc-x3000gs2-b:-:*:*:*:*:*:*:*","matchCriteriaId":"6D748C9E-0B14-404C-A0D7-4DD1DDF35C11"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:elecom:wrc-x3000gs2-w_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.08","matchCriteriaId":"B1D0B1E8-3E29-40F0-8E71-CC7B89BF8572"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:elecom:wrc-x3000gs2-w:-:*:*:*:*:*:*:*","matchCriteriaId":"70A7409C-3E07-4A7B-8248-F2090A74448B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:elecom:wrc-x3000gs2a-b_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.08","matchCriteriaId":"09A8CB6C-57A5-4B67-A128-4ACCEDB19B85"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:elecom:wrc-x3000gs2a-b:-:*:*:*:*:*:*:*","matchCriteriaId":"E2DC2AA9-297E-4FAC-B64D-64A06ED4ED1F"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"34577","Ordinal":"1","Title":"CVE-2024-34577","CVE":"CVE-2024-34577","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"34577","Ordinal":"1","NoteData":"Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, WRC-X3000GS2A-B and WRC-X3000GST2-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.","Type":"Description","Title":"CVE-2024-34577"}]}}}