Improper Validation Vulnerability in NEC Aterm Routers
CVE-2021-20709

7.2HIGH

Key Information:

Vendor

Nec Corporation

Status
Nec Aterm Devices
Vendor
CVE Published:
26 April 2021

What is CVE-2021-20709?

A vulnerability present in the firmware of NEC Aterm routers allows an attacker with administrative privileges to execute arbitrary operating system commands. This vulnerability stems from improper validation of the integrity check value, which can be exploited by sending crafted requests to specific URLs. The affected products include WF1200CR, WG1200CR, and WG2600HS models with particular firmware versions. Maintaining updated firmware is essential to mitigate the risks associated with this vulnerability.

Affected Version(s)

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier

References

https://jpn.nec.com/security-info/secinfo/nv21-010.html
x_refsource_MISC
https://jvn.jp/en/jp/JVN29739718/index.html
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.