Arbitrary Command Execution Vulnerability in NEC Aterm Devices
CVE-2021-20708

7.2HIGH

Key Information:

Vendor

Nec Corporation

Status
Nec Aterm Devices
Vendor
CVE Published:
26 April 2021

What is CVE-2021-20708?

NEC Aterm devices have a security flaw that allows authenticated attackers to execute arbitrary operating system commands by sending specially crafted HTTP requests to specific URLs. This vulnerability affects various firmware versions, posing a risk that could potentially compromise the device functionality and security. Users are advised to update their firmware to mitigate these risks.

Affected Version(s)

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier

References

https://jpn.nec.com/security-info/secinfo/nv21-010.html
x_refsource_MISC
https://jvn.jp/en/jp/JVN29739718/index.html
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.