CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20621
https://notcve.org/view.php?id=CVE-2021-20621
Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. Vulnerabilidad de tipo Cross-site request forgery (CSRF) en Aterm WG2600HP firmware versiones 1.0.2 y anteriores, y Aterm WG2600HP2 firmware versiones 1.0.2 y anteriores, permite a atacantes remotos secuestrar la autenticación de administradores por medio de vectores no especificados • https://jpn.nec.com/security-info/secinfo/nv21-005.html https://jvn.jp/en/jp/JVN38248512/index.html https://www.aterm.jp/support/tech/2019/0328.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20622
https://notcve.org/view.php?id=CVE-2021-20622
Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors. Vulnerabilidad de tipo Cross-site scripting en Aterm WG2600HP firmware versiones 1.0.2 y anteriores, y Aterm WG2600HP2 firmware versiones 1.0.2 y anteriores, permite a atacantes remotos inyectar un script arbitrario por medio de vectores no especificados • https://jpn.nec.com/security-info/secinfo/nv21-005.html https://jvn.jp/en/jp/JVN38248512/index.html https://www.aterm.jp/support/tech/2019/0328.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-12575 – NEC Aterm WG2600HP2 Information Disclosure
https://notcve.org/view.php?id=CVE-2017-12575
An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d "REQ_ID=SUPPORT_IF_GET"). Se ha descubierto un error en NEC Aterm WG2600HP2 1.0.2. • http://jvn.jp/en/jp/JVN38248512/index.html http://seclists.org/fulldisclosure/2018/Aug/26 • CWE-306: Missing Authentication for Critical Function •