High severity · published Jan 15, 2025
CVE-2025-0355
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and…
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GB
GB1200PE · NEC Corporation
Ver.1.3.0 and earlier · source: vendor
WF
WF1200CR · NEC Corporation
Ver.1.6.0 and earlier · source: vendor
WG
WG1200CR · NEC Corporation
Ver.1.5.0 and earlier · source: vendor
WG
WG2600HM4 · NEC Corporation
Ver.1.4.2 and earlier · source: vendor
WG
WG2600HP4 · NEC Corporation
Ver.1.4.2 and earlier · source: vendor
WG
WG2600HS · NEC Corporation
Ver.1.7.2 and earlier · source: vendor
WG
WG2600HS2 · NEC Corporation
Ver.1.3.2 and earlier · source: vendor
WX
WX3000HP · NEC Corporation
Ver.2.4.2 and earlier · source: vendor
WX
WX4200D5 · NEC Corporation
Ver.1.2.4 and earlier · source: vendor