Security readout for executives and security teams
Plain-English summary
Certain ELECOM WRH-300WH-H and WTC-300HWH devices have a cross-site scripting flaw. An unauthenticated remote attacker could inject script into the device’s web context. The business risk depends on where these devices are deployed and whether users or administrators can be exposed to malicious content.
Executive priority
Treat this as a targeted device hygiene issue, not a confirmed crisis. Prioritize finding affected ELECOM devices, reducing web-interface exposure, and applying vendor guidance once confirmed.
Technical view
CVE-2023-37560 is an XSS vulnerability affecting WRH-300WH-H v2.12 and earlier and WTC-300HWH v1.09 and earlier. The source bundle states remote unauthenticated script injection is possible. No CVSS score, CWE, exploit details, or confirmed fixed version are provided here.
Likely exposure
Exposure is limited to environments using the named ELECOM models at affected firmware versions. Risk is higher if the device web interface is reachable from untrusted networks or frequently accessed by administrators.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. It only supports that remote unauthenticated script injection is possible against affected versions.
Researcher notes
Available evidence is sparse: no CVSS vector, CWE, patch version, or exploit telemetry is included in the bundle. Analysis should stay model- and version-specific and avoid assuming broader ELECOM impact.
Mitigation direction
- Inventory ELECOM WRH-300WH-H and WTC-300HWH devices and firmware versions.
- Review ELECOM and JVN advisories for official firmware or workaround guidance.
- Apply only vendor-published updates or mitigations for the exact affected model.
- Restrict device management access to trusted administrative networks where feasible.
- Replace or remove affected devices if no supported vendor fix is available.
Validation and detection
- Confirm whether deployed firmware is WRH-300WH-H v2.12 or earlier.
- Confirm whether deployed firmware is WTC-300HWH v1.09 or earlier.
- Check whether the device web interface is reachable from untrusted networks.
- Verify remediation against ELECOM or JVN guidance after changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-37560 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.elecom.co.jp/news/security/20230711-01/CVE reference
- https://jvn.jp/en/jp/JVN05223215/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.