Medium severity · published Jun 28, 2023
CVE-2023-3332
Improper Neutralization of Input During Web Page Generation vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP,…
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to
execute an arbitrary script, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Aterm Wf300hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg1400hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg1800hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg1800hp2 Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg2200hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg2600hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg2600hp2 Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg300hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wg600hp Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wr8170n Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wr8175n Firmware · Nec
All versions, or not specified · source: NVD
AW
Aterm Wr8370n Firmware · Nec
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3332
Broken Link
https://https://jpn.nec.com/security-info/secinfo/nv23-007_en.html
More from Aterm Wf300hp Firmware
9.8
CVE-2024-28015
Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2,…
9.8
CVE-2024-28014
Stack-based Buffer Overflow vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS,…
9.8
CVE-2024-28012
Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS,…
9.8
CVE-2024-28011
Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS,…
9.8
CVE-2024-28010
Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP,…