by Kastro
Paper/Archive/CVE-2024-28015

CVE-2024-28015

NEC Corporation WG1800HP4 — Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2,…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.2.522 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary OS command with the root privilege via the internet.

Affected

ProductAffectedFixed inSource
WG1800HP4all versions–CNA
WG1200HS3all versions–CNA
WG1900HP2all versions–CNA
WG1200HP3all versions–CNA
WG1800HP3all versions–CNA
WG1200HS2all versions–CNA
WG1900HPall versions–CNA
WG1200HP2all versions–CNA
W1200EX(-MS)all versions–CNA
WG1200HSall versions–CNA
WG1200HPall versions–CNA
WF300HP2all versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refjpn.nec.com/security-info/secinfo/nv24-001_en.htmlrefhttps://jpn.nec.com/security-info/secinfo/nv24-001_en.html