CVE-2021-20708
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
NEC Aterm devices (Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier) allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL.
Unos dispositivos NEC Aterm (firmware Aterm WF1200CR versiones Ver1.3.2 y anteriores, firmware Aterm WG1200CR versiones Ver1.3.3 y anteriores, y firmware Aterm WG2600HS versiones Ver1.5.1 y anteriores) permiten a atacantes autenticados ejecutar comandos arbitrarios del Sistema Operativo mediante el envio de una petición especialmente diseñada a una URL específica
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-12-17 CVE Reserved
- 2021-04-26 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://jvn.jp/en/jp/JVN29739718/index.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://jpn.nec.com/security-info/secinfo/nv21-010.html | 2021-05-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Nec Search vendor "Nec" | Aterm Wf1200cr Firmware Search vendor "Nec" for product "Aterm Wf1200cr Firmware" | <= 1.3.2 Search vendor "Nec" for product "Aterm Wf1200cr Firmware" and version " <= 1.3.2" | - |
Affected
| in | Nec Search vendor "Nec" | Aterm Wf1200cr Search vendor "Nec" for product "Aterm Wf1200cr" | - | - |
Safe
|
| Nec Search vendor "Nec" | Aterm Wg1200cr Firmware Search vendor "Nec" for product "Aterm Wg1200cr Firmware" | <= 1.3.3 Search vendor "Nec" for product "Aterm Wg1200cr Firmware" and version " <= 1.3.3" | - |
Affected
| in | Nec Search vendor "Nec" | Aterm Wg1200cr Search vendor "Nec" for product "Aterm Wg1200cr" | - | - |
Safe
|
| Nec Search vendor "Nec" | Aterm Wg2600hs Firmware Search vendor "Nec" for product "Aterm Wg2600hs Firmware" | <= 1.5.1 Search vendor "Nec" for product "Aterm Wg2600hs Firmware" and version " <= 1.5.1" | - |
Affected
| in | Nec Search vendor "Nec" | Aterm Wg2600hs Search vendor "Nec" for product "Aterm Wg2600hs" | - | - |
Safe
|