vulnwire
7.2high

CVE-2023-3333

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1…

Published 3 y ago · modified 4 mo ago · JSON

CVSS
7.2
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction (EPSS)

0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • NEC Corporation Aterm WG2600HP2
  • NEC Corporation Aterm WG2600HP
  • NEC Corporation Aterm WG2200HP
  • NEC Corporation Aterm WG1800HP2
  • NEC Corporation Aterm WG1800HP
  • NEC Corporation Aterm WG1400HP
  • NEC Corporation Aterm WG600HP
  • NEC Corporation Aterm WG300HP
  • NEC Corporation Aterm WF300HP
  • NEC Corporation Aterm WR9500N
  • NEC Corporation Aterm WR9300N
  • NEC Corporation Aterm WR8750N
  • NEC Corporation Aterm WR8700N
  • NEC Corporation Aterm WR8600N
  • NEC Corporation Aterm WR8370N
  • NEC Corporation Aterm WR8175N
  • NEC Corporation Aterm WR8170N

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • https //jpn.nec.com/security-info/secinfo/nv23-007_en.html · x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.