CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-20709
https://notcve.org/view.php?id=CVE-2021-20709
Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to a specific URL. Una validación inapropiada de la vulnerabilidad del valor de comprobación de integridad en NEC Aterm WF1200CR firmware Ver1.3.2 y anterior, Aterm WG1200CR firmware Ver1.3.3 y anterior, y Aterm WG2600HS firmware Ver1.5.1 y anterior permite a un atacante con privilegios administrativos ejecutar comandos arbitrarios del Sistema Operativo mediante el envio de una petición especialmente diseñada a una URL específica • https://jpn.nec.com/security-info/secinfo/nv21-010.html https://jvn.jp/en/jp/JVN29739718/index.html • CWE-354: Improper Validation of Integrity Check Value •
CVSS: 9.0EPSS: 0%CPEs: 6EXPL: 0CVE-2021-20708
https://notcve.org/view.php?id=CVE-2021-20708
NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier) allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL. Unos dispositivos NEC Aterm (firmware Aterm WF1200CR versiones Ver1.3.2 y anteriores, firmware Aterm WG1200CR versiones Ver1.3.3 y anteriores, y firmware Aterm WG2600HS versiones Ver1.5.1 y anteriores) permiten a atacantes autenticados ejecutar comandos arbitrarios del Sistema Operativo mediante el envio de una petición especialmente diseñada a una URL específica • https://jpn.nec.com/security-info/secinfo/nv21-010.html https://jvn.jp/en/jp/JVN29739718/index.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16192
https://notcve.org/view.php?id=CVE-2018-16192
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors. Aterm WF1200CR y Aterm WG1200CR (Aterm WF1200CR con firmware en versiones 1.1.1 y anteriores y Aterm WG1200CR con firmware en versiones 1.0.1 y anteriores) permiten que un atacante en el mismo segmento de red obtenga información registrada en el dispositivo mediante vectores sin especificar. • https://jpn.nec.com/security-info/secinfo/nv18-021.html https://jvn.jp/en/jp/JVN87535892/index.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16195
https://notcve.org/view.php?id=CVE-2018-16195
Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands via SOAP interface of UPnP. Aterm WF1200CR y Aterm WG1200CR (Aterm WF1200CR con firmware en versiones 1.1.1 y anteriores y Aterm WG1200CR con firmware en versiones 1.0.1 y anteriores) permiten que un atacante en el mismo segmento de red ejecute comandos arbitrarios del sistema operativo mediante la interfaz SOAP de UPnP. • https://jpn.nec.com/security-info/secinfo/nv18-021.html https://jvn.jp/en/jp/JVN87535892/index.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2018-16193
https://notcve.org/view.php?id=CVE-2018-16193
Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad Cross-Site Scripting (XSS) en Aterm WF1200CR y Aterm WG1200CR (Aterm WF1200CR con firmware en versiones 1.1.1 y anteriores y Aterm WG1200CR con firmware en versiones 1.0.1 y anteriores) permite que los atacantes autenticados inyecten scripts web o HTML arbitrarios mediante vectores sin especificar. • https://jpn.nec.com/security-info/secinfo/nv18-021.html https://jvn.jp/en/jp/JVN87535892/index.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •