CVE-2021-20860: Elecom Edwrc-2533gst2 Firmware

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior, WRC-1750GSV firmware v2.11 and prior, WRC-1900GST firmware v1.03 and prior, WRC-2533GST firmware v1.03 and prior, WRC-2533GSTA firmware v1.03 and prior, WRC-2533GST2 firmware v1.25 and prior, WRC-2533GST2SP firmware v1.25 and prior, WRC-2533GST2-G firmware v1.25 and prior, and EDWRC-2533GST2 firmware v1.25 and prior) allows a remote authenticated attacker to hijack the authentication of an administrator via a specially crafted page.

Affected products

• Elecom Edwrc-2533gst2 Firmware: up to and including 1.25
• Elecom Wrc-1167gst2 Firmware: up to and including 1.25
• Elecom Wrc-1167gst2a Firmware: up to and including 1.25
• Elecom Wrc-1167gst2h Firmware: up to and including 1.25
• Elecom Wrc-1750gs Firmware: up to and including 1.03
• Elecom Wrc-1750gsv Firmware: up to and including 2.11
• Elecom Wrc-1900gst Firmware: up to and including 1.03
• Elecom Wrc-2533gs2-B Firmware: up to and including 1.52
• Elecom Wrc-2533gs2-W Firmware: up to and including 1.52
• Elecom Wrc-2533gst2-G Firmware: up to and including 1.25
• Elecom Wrc-2533gst2 Firmware: up to and including 1.25
• Elecom Wrc-2533gst2sp Firmware: up to and including 1.25
• Elecom Wrc-2533gst Firmware: up to and including 1.03
• Elecom Wrc-2533gsta Firmware: up to and including 1.03

Published 2021-12-01. Last modified 2026-06-17.