CVE-2024-23910: Elecom WRC-1167GS2-B CSRF Vulnerability

CVE-2024-23910 Overview

CVE-2024-23910 is a cross-site request forgery (CSRF) vulnerability affecting multiple ELECOM wireless LAN routers and a wireless LAN repeater. A remote unauthenticated attacker can hijack the authentication of administrators and force them to perform unintended operations on the affected product. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery. Note that WMC-X1800GST-B and WSC-X1800GS-B are also bundled in the e-Mesh Starter Kit WMC-2LX-B, expanding the population of impacted deployments.

Critical Impact
Successful exploitation lets an attacker change router configuration with administrator privileges, enabling network hijacking, DNS redirection, and persistent access to the victim's local network.

Affected Products

ELECOM WRC-1167GS2-B, WRC-1167GS2H-B, WRC-1167GST2 firmware
ELECOM WRC-2533GS2-B, WRC-2533GS2-W, WRC-2533GS2V-B, WRC-2533GST2, WRC-X3200GST3-B, WRC-G01-W firmware
ELECOM WMC-X1800GST-B and WSC-X1800GS-B firmware (also shipped as e-Mesh Starter Kit WMC-2LX-B)

Discovery Timeline

2024-02-28 - CVE-2024-23910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23910

Vulnerability Analysis

The affected ELECOM routers expose an administrative web interface that processes state-changing requests without verifying their origin. The interface lacks anti-CSRF tokens, strict SameSite cookie attributes, and Origin/Referer header validation. An authenticated administrator who visits a malicious page can have their browser silently submit forged requests to the router's LAN-side management URL.

Because the router trusts the session cookie attached by the browser, the forged request is executed with full administrator privileges. The attack vector is classed as Network with user interaction required, reflecting the need for the administrator to load attacker-controlled content.

Root Cause

The root cause is missing origin validation on administrative endpoints, mapped to CWE-352. The web management application does not bind requests to a per-session unpredictable token, so the router cannot distinguish between requests issued by the legitimate management UI and those triggered by a third-party site.

Attack Vector

Exploitation typically follows this pattern. The attacker hosts a page containing an auto-submitting HTML form or hidden image referencing a router administrative endpoint such as a password change, DNS configuration, remote management toggle, or firmware update URL. When the administrator (already authenticated to the router) loads the page, the browser attaches the router session cookie and the unintended action is performed. No exploit code is publicly available, and the issue is not listed in the CISA KEV catalog.

For full technical details, refer to the JVN #44166658 Advisory and the Elecom Security Notice.

Detection Methods for CVE-2024-23910

Indicators of Compromise

Unexpected changes to router administrative settings such as DNS servers, DHCP options, port forwarding entries, or remote management state.
HTTP POST or GET requests to router management URLs that carry an external Referer or Origin header.
Unexplained administrator password resets or new administrative accounts on affected ELECOM devices.

Detection Strategies

Inspect router and gateway access logs for state-changing requests whose Referer does not match the LAN management origin.
Monitor outbound DNS traffic from client devices for resolvers not configured by the network owner, indicating possible DNS hijack via CSRF.
Review browser proxy or NDR telemetry for client connections to attacker pages immediately preceding router configuration changes.

Monitoring Recommendations

Alert on any administrative configuration change to ELECOM devices outside approved change windows.
Baseline expected DNS servers and gateway settings on managed endpoints and alert on deviation.
Track first-seen connections from administrator workstations to uncategorized web sites while a router admin session is active.

How to Mitigate CVE-2024-23910

Immediate Actions Required

Apply the firmware updates listed in the Elecom Security Notice for every affected model, including units shipped in the WMC-2LX-B e-Mesh Starter Kit.
Log out of the router administrative interface after each session and avoid browsing other sites in the same browser profile while authenticated.
Change the administrator password and review router configuration (DNS, port forwarding, remote access) for unauthorized changes.

Patch Information

ELECOM has published updated firmware and mitigation guidance in the vendor advisory at Elecom Security Notice 20240220-01. Coordinated disclosure was handled through JPCERT/CC and tracked as JVN #44166658. Administrators should consult these advisories for model-specific firmware versions.

Workarounds

Restrict access to the router management interface to a dedicated administrative host or VLAN.
Use a separate browser or browser profile exclusively for router administration to prevent session reuse from general browsing.
Disable remote (WAN-side) management and ensure the default administrator credentials have been replaced with strong, unique values.

bash

# Configuration example: verify and harden ELECOM router posture after patching
# 1) Confirm firmware version via the admin UI matches the fixed release listed by ELECOM
# 2) Disable WAN-side administration
# 3) Reset administrator password and audit DNS / port-forwarding entries