All the vulnerabilites related to NEC Corporation - Aterm WF800HP firmware
jvndb-2021-000028
Vulnerability from jvndb
Published
2021-04-09 17:16
Modified
2021-04-09 17:16
Severity ?
Summary
Multiple vulnerabilities in multiple Aterm products
Details
Multiple Aterm products provided by NEC Corporation contain multiple vulnerabilities listed below.
*Cross-site Scripting (CWE-79) - CVE-2021-20680
*OS command injection via UPnP (CWE-78) - CVE-2014-8361
CVE-2021-20680
Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2014-8361
Satoru Nagaoka of Cyber Defense Institute, Inc, Katsuhiko Sato (a.k.a. goroh_kun) and Ryo Kashiro of 00One, Inc. and Rintaro Fujita of Nippon Telegraph and Telephone Corporation reported to IPA that CVE-2014-8361 vulnerability still exists in NEC Corporation products. JPCERT/CC coordinated with the developer.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000028.html", "dc:date": "2021-04-09T17:16+09:00", "dcterms:issued": "2021-04-09T17:16+09:00", "dcterms:modified": "2021-04-09T17:16+09:00", "description": "Multiple Aterm products provided by NEC Corporation contain multiple vulnerabilities listed below.\r\n\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20680\r\n*OS command injection via UPnP (CWE-78) - CVE-2014-8361\r\n\r\nCVE-2021-20680\r\nToshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2014-8361\r\nSatoru Nagaoka of Cyber Defense Institute, Inc, Katsuhiko Sato (a.k.a. goroh_kun) and Ryo Kashiro of 00One, Inc. and Rintaro Fujita of Nippon Telegraph and Telephone Corporation reported to IPA that CVE-2014-8361 vulnerability still exists in NEC Corporation products. JPCERT/CC coordinated with the developer.", "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000028.html", "sec:cpe": [ { "#text": "cpe:/o:nec:aterm_w1200ex-ms_firmware", "@product": "Aterm W1200EX-MS firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_w1200ex_firmware", "@product": "Aterm W1200EX firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_w300p_firmware", "@product": "Aterm W300P firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_w500p_firmware", "@product": "Aterm W500P firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wf300hp2_firmware", "@product": "Aterm WF300HP2 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wf800hp_firmware", "@product": "Aterm WF800HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hp2_firmware", "@product": "Aterm WG1200HP2 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hp3_firmware", "@product": "Aterm WG1200HP3 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hp_firmware", "@product": "Aterm WG1200HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hs2_firmware", "@product": "Aterm WG1200HS2 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hs3_firmware", "@product": "Aterm WG1200HS3 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1200hs_firmware", "@product": "Aterm WG1200HS firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1800hp3_firmware", "@product": "Aterm WG1800HP3 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1800hp4_firmware", "@product": "Aterm WG1800HP4 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1900hp2_firmware", "@product": "Aterm WG1900HP2 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg1900hp_firmware", "@product": "Aterm WG1900HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wr8165n_firmware", "@product": "Aterm WR8165N firmware", "@vendor": "NEC Corporation", "@version": "2.2" } ], "sec:cvss": [ { "@score": "5.8", "@severity": "Medium", "@type": "Base", "@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "@version": "2.0" }, { "@score": "8.8", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "@version": "3.0" } ], "sec:identifier": "JVNDB-2021-000028", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN67456944/index.html", "@id": "JVN#67456944", "@source": "JVN" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8361", "@id": "CVE-2014-8361", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20680", "@id": "CVE-2021-20680", "@source": "CVE" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2014-8361", "@id": "CVE-2014-8361", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20680", "@id": "CVE-2021-20680", "@source": "NVD" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-78", "@title": "OS Command Injection(CWE-78)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)" } ], "title": "Multiple vulnerabilities in multiple Aterm products" }
jvndb-2021-000006
Vulnerability from jvndb
Published
2021-01-22 17:55
Modified
2021-02-03 12:05
Severity ?
Summary
Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2
Details
Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities.
Aterm WF800HP:
*Cross-site Scripting (CWE-79) - CVE-2021-20620
Aterm WG2600HP and Aterm WG2600HP2:
*Improper Access Control (CWE-284) - CVE-2017-12575
*Cross-Site Request Forgery (CWE-352) - CVE-2021-20621
*Cross-site Scripting (CWE-79) - CVE-2021-20622
CVE-2021-20620
Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2021-20621, CVE-2021-20622
Noriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000006.html", "dc:date": "2021-02-03T12:05+09:00", "dcterms:issued": "2021-01-22T17:55+09:00", "dcterms:modified": "2021-02-03T12:05+09:00", "description": "Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities.\r\n\r\nAterm WF800HP:\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20620\r\n\r\nAterm WG2600HP and Aterm WG2600HP2:\r\n*Improper Access Control (CWE-284) - CVE-2017-12575\r\n*Cross-Site Request Forgery (CWE-352) - CVE-2021-20621\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20622\r\n\r\nCVE-2021-20620\r\nSatoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2021-20621, CVE-2021-20622\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000006.html", "sec:cpe": [ { "#text": "cpe:/o:nec:aterm_wf800hp_firmware", "@product": "Aterm WF800HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg2600hp2_firmware", "@product": "Aterm WG2600HP2 firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, { "#text": "cpe:/o:nec:aterm_wg2600hp_firmware", "@product": "Aterm WG2600HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" } ], "sec:cvss": [ { "@score": "4.3", "@severity": "Medium", "@type": "Base", "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "@version": "2.0" }, { "@score": "7.5", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "@version": "3.0" } ], "sec:identifier": "JVNDB-2021-000006", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN38248512/index.html", "@id": "JVN#38248512", "@source": "JVN" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12575", "@id": "CVE-2017-12575", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20620", "@id": "CVE-2021-20620", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20621", "@id": "CVE-2021-20621", "@source": "CVE" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20622", "@id": "CVE-2021-20622", "@source": "CVE" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20620", "@id": "CVE-2021-20620", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20621", "@id": "CVE-2021-20621", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20622", "@id": "CVE-2021-20622", "@source": "NVD" }, { "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-12575", "@id": "CVE-2017-12575", "@source": "NVD" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-264", "@title": "Permissions(CWE-264)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-352", "@title": "Cross-Site Request Forgery(CWE-352)" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-79", "@title": "Cross-site Scripting(CWE-79)" } ], "title": "Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2" }
jvndb-2016-000035
Vulnerability from jvndb
Published
2016-03-30 14:49
Modified
2016-04-18 15:42
Severity ?
Summary
Aterm WF800HP vulnerable to cross-site request forgery
Details
Aterm WF800HP provided by NEC Corporation contains a cross-site request forgery vulnerability (CWE-352).
Satoshi Ogawa of Mitsui Bussan Secure Directions,Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
▼ | Type | URL |
---|---|---|
JVN | https://jvn.jp/en/jp/JVN07818796/index.html | |
CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1168 | |
NVD | https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1168 | |
Cross-Site Request Forgery(CWE-352) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
Impacted products
▼ | Vendor | Product |
---|---|---|
NEC Corporation | Aterm WF800HP firmware |
{ "@rdf:about": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000035.html", "dc:date": "2016-04-18T15:42+09:00", "dcterms:issued": "2016-03-30T14:49+09:00", "dcterms:modified": "2016-04-18T15:42+09:00", "description": "Aterm WF800HP provided by NEC Corporation contains a cross-site request forgery vulnerability (CWE-352).\r\n\r\nSatoshi Ogawa of Mitsui Bussan Secure Directions,Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.", "link": "https://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000035.html", "sec:cpe": { "#text": "cpe:/o:nec:aterm_wf800hp_firmware", "@product": "Aterm WF800HP firmware", "@vendor": "NEC Corporation", "@version": "2.2" }, "sec:cvss": [ { "@score": "4.0", "@severity": "Medium", "@type": "Base", "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "@version": "2.0" }, { "@score": "7.1", "@severity": "High", "@type": "Base", "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "@version": "3.0" } ], "sec:identifier": "JVNDB-2016-000035", "sec:references": [ { "#text": "https://jvn.jp/en/jp/JVN07818796/index.html", "@id": "JVN#07818796", "@source": "JVN" }, { "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1168", "@id": "CVE-2016-1168", "@source": "CVE" }, { "#text": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1168", "@id": "CVE-2016-1168", "@source": "NVD" }, { "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html", "@id": "CWE-352", "@title": "Cross-Site Request Forgery(CWE-352)" } ], "title": "Aterm WF800HP vulnerable to cross-site request forgery" }