CVE-2025-43877 Overview
CVE-2025-43877 is a stored cross-site scripting (XSS) vulnerability in the WebGUI of the Elecom WRC-1167GHBK2-S wireless router. An authenticated attacker with low privileges can inject arbitrary script content that persists in the device configuration. The payload executes in the browser of any user who later accesses the affected WebGUI pages. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows execution of attacker-controlled script in the context of the router's management interface, enabling session abuse, configuration tampering, or redirection of administrators.
Affected Products
- Elecom WRC-1167GHBK2-S wireless router
- WebGUI management interface of the above device
- Firmware versions listed in the vendor advisory
Discovery Timeline
- 2025-06-24 - CVE-2025-43877 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43877
Vulnerability Analysis
The WebGUI of the WRC-1167GHBK2-S fails to properly neutralize user-supplied input before storing it and rendering it back in administrative pages. An authenticated user with access to configurable fields can submit script content that the server persists in device state. When another user, typically an administrator, loads the affected page, the browser interprets the stored payload as executable JavaScript. The result is script execution in the trusted origin of the router's management interface.
Because the attack requires user interaction with the WebGUI, exploitation depends on an administrator visiting the affected view after injection. The impact remains limited to the confidentiality and integrity of the browser session interacting with the device, not direct code execution on the router itself.
Root Cause
The root cause is missing or insufficient output encoding on data read from device configuration storage and rendered into HTML responses. Input validation on the write path also fails to strip or neutralize HTML and script syntax, so hostile strings are stored verbatim and later reflected to the DOM.
Attack Vector
The attack vector is network-based against the WebGUI, with low privileges required and user interaction needed to trigger execution. An attacker who holds valid credentials, or who leverages another weakness to reach the management interface, submits a payload into a vulnerable field. The stored payload fires each time a privileged user opens the affected page.
No verified proof-of-concept code has been published. Technical details are available in the JVN Vulnerability Report JVN39435597 and the Elecom Security News Update.
Detection Methods for CVE-2025-43877
Indicators of Compromise
- Configuration fields in the router WebGUI containing <script> tags, on* event handlers, or javascript: URIs.
- Unexpected outbound HTTP requests from administrator browsers immediately after loading the router management console.
- Unauthorized changes to router settings following a management session.
Detection Strategies
- Review stored WebGUI configuration values for HTML or JavaScript syntax that should not appear in device settings.
- Inspect HTTP responses from the router for reflected script content when rendering administrative pages.
- Correlate browser-side script errors or Content Security Policy violations observed when accessing the router UI.
Monitoring Recommendations
- Monitor administrative access to the router WebGUI and alert on access from unexpected hosts or networks.
- Capture and retain WebGUI request and response bodies at a network inspection point for forensic review.
- Track configuration change events on the device and compare against an approved baseline.
How to Mitigate CVE-2025-43877
Immediate Actions Required
- Restrict access to the WRC-1167GHBK2-S WebGUI to trusted management networks only.
- Rotate administrative credentials for the device and disable any unused accounts.
- Audit existing device configuration for injected HTML or script content and remove it.
Patch Information
Elecom has published vendor guidance for CVE-2025-43877. Review the Elecom Security News Update and the JVN Vulnerability Report JVN39435597 for the current firmware status, remediation guidance, and any end-of-life notices applicable to the WRC-1167GHBK2-S.
Workarounds
- Disable remote management of the WebGUI and allow administration only from a dedicated management segment.
- Use a separate browser profile or isolated workstation for router administration to limit session reuse.
- Clear browser session data after each administrative session to reduce the window for stored payload abuse.
# Example firewall rule restricting WebGUI access to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
