Cross-Site Scripting Vulnerability in NEC Aterm Routers
CVE-2025-0354

4.8MEDIUM

Key Information:

Vendor

Nec Corporation

Status
Wg2600hs
Wg2600HP4
Wg2600hm4
Wg2600hs2
Vendor
CVE Published:
15 January 2025

What is CVE-2025-0354?

NEC Corporation's Aterm routers are prone to a Cross-Site Scripting vulnerability that allows attackers to inject malicious scripts through the internet. This can lead to unauthorized access and potential data exposures. Affected versions include WG2600HS, WG2600HP4, WG2600HM4, WG2600HS2, WX3000HP, and WX4200D5, raising serious security concerns for users who have not updated to the latest software versions.

Affected Version(s)

WG2600HM4 Ver.1.4.2 and earlier

WG2600HP4 Ver.1.4.2 and earlier

WG2600HS Ver.1.7.2 and earlier

References

https://jpn.nec.com/security-info/secinfo/nv25-003_en.html

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University.
.
CVE-2025-0354 : Cross-Site Scripting Vulnerability in NEC Aterm Routers