Authentication Flaw in NEC Aterm Wireless Routers
CVE-2024-28009

9.8CRITICAL

Key Information:

Vendor: Nec Corporation
Status: Wg1800HP4; Wg1200hs3; Wg1900HP2; Wg1200HP3
Vendor: CVE Published:; 28 March 2024

🔔 Create Nec Corporation Vulnerability Alert

What is CVE-2024-28009?

An improper authentication vulnerability in multiple models of NEC Aterm wireless routers allows attackers to execute arbitrary commands with root privileges via the internet. This flaw affects a wide range of devices, potentially compromising network security and enabling unauthorized access to sensitive functionalities.

Affected Version(s)

CR2500P all versions

MR01LN all versions

MR02LN all versions

References

https://jpn.nec.com/security-info/secinfo/nv24-001_en.html

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 28, 2024
Vulnerability Reserved
Feb 29, 2024

Credit

Katsuhiko Sato and Ryo Kashiro of 00One, Inc.