CVE-2021-20864 is an improper access control vulnerability affecting multiple ELECOM router models, including the WRC-1167GST2 and WRC-2533GS2 series, with specific firmware versions. This high-severity vulnerability (CVSS 8.8) allows a network-adjacent, unauthenticated attacker to bypass access restrictions, activate the telnet service, and execute arbitrary operating system commands. While the exploitability is high due to low attack complexity and no user interaction required, there is currently no public exploit code (Metasploit, Nuclei, ExploitDB) and no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.25CPE matchmatch criteria | cpe:2.3:o:elecom:wrc-1167gst2_firmware:*:*:*:*:*:*:*:* | ||
<= 1.25CPE matchmatch criteria | cpe:2.3:o:elecom:wrc-1167gst2a_firmware:*:*:*:*:*:*:*:* | ||
<= 1.25CPE matchmatch criteria | cpe:2.3:o:elecom:wrc-1167gst2h_firmware:*:*:*:*:*:*:*:* | ||
<= 1.52CPE matchmatch criteria | cpe:2.3:o:elecom:wrc-2533gs2-b_firmware:*:*:*:*:*:*:*:* | ||
<= 1.52CPE matchmatch criteria | cpe:2.3:o:elecom:wrc-2533gs2-w_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.