by Kastro
Paper/Archive/CVE-2024-28009

CVE-2024-28009

NEC Corporation WG1800HP4 — Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.2.512 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary command with the root privilege via the internet.

Affected

ProductAffectedFixed inSource
WG1800HP4all versions–CNA
WG1200HS3all versions–CNA
WG1900HP2all versions–CNA
WG1200HP3all versions–CNA
WG1800HP3all versions–CNA
WG1200HS2all versions–CNA
WG1900HPall versions–CNA
WG1200HP2all versions–CNA
W1200EX(-MS)all versions–CNA
WG1200HSall versions–CNA
WG1200HPall versions–CNA
WF300HP2all versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjpn.nec.com/security-info/secinfo/nv24-001_en.htmlrefhttps://jpn.nec.com/security-info/secinfo/nv24-001_en.html