CVE-2024-42412: ELECOM WAB-S1167-PS XSS Vulnerability

CVE-2024-42412 Overview

CVE-2024-42412 is a reflected cross-site scripting (XSS) vulnerability in ELECOM wireless access points. The flaw resides in menu.cgi, which fails to properly sanitize input values before rendering them in the administrative interface. An attacker who convinces an authenticated administrator to visit a crafted web page can trigger arbitrary script execution in the administrator's browser session. The issue is tracked under [CWE-79] and affects the ELECOM WAB-S1167-PS and WAB-I1750-PS access points along with their firmware.

Critical Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator, potentially leading to session compromise, configuration changes, or pivoting into the internal network.

Affected Products

ELECOM WAB-S1167-PS (hardware and firmware)
ELECOM WAB-I1750-PS (hardware and firmware)
Deployments exposing the menu.cgi administrative interface

Discovery Timeline

2024-08-27 - ELECOM publishes security advisory 20240827-01
2024-08-30 - CVE-2024-42412 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42412

Vulnerability Analysis

The vulnerability is a classic reflected cross-site scripting flaw in the web-based management interface of affected ELECOM access points. The menu.cgi endpoint accepts request parameters and reflects them into HTML output without proper encoding or filtering. When an authenticated administrator loads a page containing attacker-controlled input, the browser parses the injected markup as executable script.

Because the payload executes in the administrator's authenticated session, an attacker can read or modify device configuration, harvest credentials from the browser context, or issue further requests to the access point. Exploitation requires user interaction, typically clicking a crafted link or visiting a malicious page while logged in.

Root Cause

The root cause is improper neutralization of input during web page generation in menu.cgi. The CGI handler concatenates user-supplied parameters into HTML responses without HTML-entity encoding or contextual output escaping. No Content Security Policy (CSP) or equivalent browser-side mitigation is applied to reduce the impact of injected script.

Attack Vector

Exploitation follows a standard reflected XSS delivery pattern:

The attacker crafts a URL targeting menu.cgi on the victim's access point with a malicious script payload embedded in a vulnerable parameter.
The attacker delivers the URL to an administrator through phishing, chat, or a malicious website.
The administrator, while authenticated to the device, follows the link or loads the malicious page that references the vulnerable endpoint.
The access point reflects the payload into the response, and the administrator's browser executes the script within the trusted origin of the management interface.

No verified public exploit code is available. The vulnerability is described in prose based on the JVN Advisory JVN24885537 and the Elecom Security News Report.

Detection Methods for CVE-2024-42412

Indicators of Compromise

Requests to menu.cgi containing HTML or JavaScript tokens such as <script, onerror=, onload=, or URL-encoded equivalents like %3Cscript.
Unexpected outbound requests from administrator workstations to external hosts immediately after loading the device management interface.
Configuration changes on the access point that do not correlate with legitimate administrator activity in change-management logs.

Detection Strategies

Inspect HTTP access logs on the access point and any intermediate proxies for suspicious query strings targeting menu.cgi.
Deploy web filtering or URL reputation controls that flag links pointing to internal management interfaces with embedded script payloads.
Correlate authenticated administrator sessions with anomalous browser-originated requests using endpoint telemetry.

Monitoring Recommendations

Restrict and monitor access to the access point management network segment, alerting on any source outside the approved administrative range.
Log administrator authentication events and configuration changes, and review them for activity outside expected maintenance windows.
Alert on browser processes on administrator workstations initiating unexpected requests to management URLs shortly after visiting external sites.

How to Mitigate CVE-2024-42412

Immediate Actions Required

Apply the firmware update referenced in the Elecom Security News Report as soon as it is available for your model.
Remove management interfaces from any network reachable by untrusted users, including the internet and general user LAN segments.
Log administrators out of the device when not actively performing maintenance to reduce the window in which reflected XSS can be triggered.

Patch Information

ELECOM published advisory 20240827-01 describing the issue and remediation guidance. Consult the Elecom Security News Report and the JVN Advisory JVN24885537 for the current fixed firmware versions and update procedures for the WAB-S1167-PS and WAB-I1750-PS models.

Workarounds

Restrict administrative access to a dedicated management VLAN reachable only from hardened jump hosts.
Use a browser profile dedicated to device administration, with no general web browsing performed in the same session.
Enforce firewall rules that block direct connections to menu.cgi from any source other than approved administrator addresses.

bash

# Example firewall rule limiting access to the ELECOM management interface
# Replace the interface, management subnet, and device IP for your environment
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 \
  -s 10.10.20.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP