Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
228 vulnerabilities by NEC Corporation
JVNDB-2026-000078
Vulnerability from jvndb - Published: 2026-05-25 15:35 - Updated:2026-05-25 18:06
Severity
Summary
NEC Aterm series vulnerable to cross-site scripting (NV26-002)
Details
Aterm series products provided by NEC Corporation contain the following vulnerability.
- Cross-site scripting (CWE-79) - CVE-2026-6059
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000078.html",
"dc:date": "2026-05-25T18:06+09:00",
"dcterms:issued": "2026-05-25T15:35+09:00",
"dcterms:modified": "2026-05-25T18:06+09:00",
"description": "Aterm series products provided by NEC Corporation contain the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/79.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2026-6059\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2026-6059\u003c/li\u003e\u003c/ul\u003eNoriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000078.html",
"sec:cpe": [
{
"#text": "cpe:/o:nec:aterm_19000t12be",
"@product": "Aterm 19000T12BE",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_gx621a1",
"@product": "Aterm GX621A1",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_sh621a1",
"@product": "Aterm SH621A1",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx11000t12",
"@product": "Aterm WX11000T12",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx1800hp",
"@product": "Aterm WX1800HP",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx3000hp2",
"@product": "Aterm WX3000HP2",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx4200d5",
"@product": "Aterm WX4200D5",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx5400hp",
"@product": "Aterm WX5400HP",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx7800t8",
"@product": "Aterm WX7800T8",
"@vendor": "NEC Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "3.8",
"@severity": "Low",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-000078",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN69049186/index.html",
"@id": "JVN#69049186",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-6059",
"@id": "CVE-2026-6059",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "NEC Aterm series vulnerable to cross-site scripting (NV26-002)"
}
JVNDB-2026-000079
Vulnerability from jvndb - Published: 2026-05-25 15:35 - Updated:2026-05-25 18:14
Severity
Summary
NEC Aterm series vulnerable to OS command injection (NV26-003)
Details
NEC Aterm series products provided by NEC Corporation contain the following vulnerability.
- OS command injection (CWE-78) - CVE-2026-8652
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000079.html",
"dc:date": "2026-05-25T18:14+09:00",
"dcterms:issued": "2026-05-25T15:35+09:00",
"dcterms:modified": "2026-05-25T18:14+09:00",
"description": "NEC Aterm series products provided by NEC Corporation contain the following vulnerability.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2026-8652\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eOS command injection (CWE-78) - CVE-2026-8652\u003c/li\u003e\u003c/ul\u003eSo Kato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000079.html",
"sec:cpe": [
{
"#text": "cpe:/o:nec:aterm_cm51fd",
"@product": "Aterm CM51FD",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_mr51fn",
"@product": "Aterm MR51FN",
"@vendor": "NEC Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "6.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2026-000079",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN80890147/index.html",
"@id": "JVN#80890147",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-8652",
"@id": "CVE-2026-8652",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
}
],
"title": "NEC Aterm series vulnerable to OS command injection (NV26-003)"
}
JVNDB-2026-000049
Vulnerability from jvndb - Published: 2026-04-03 15:09 - Updated:2026-04-03 15:09Summary
Multiple vulnerabilities in NEC Aterm series (NV26-001)
Details
Aterm series products provided by NEC Corporation contain multiple vulnerabilities listed below.
- Missing authorization (CWE-862) - CVE-2026-4309
- Path traversal (CWE-22) - CVE-2026-4619
- OS command injection (CWE-78) - CVE-2026-4620, CVE-2026-4622
- Hidden functionality (CWE-912) - CVE-2026-4621
References
| Type | URL | |
|---|---|---|
|
|
||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000049.html",
"dc:date": "2026-04-03T15:09+09:00",
"dcterms:issued": "2026-04-03T15:09+09:00",
"dcterms:modified": "2026-04-03T15:09+09:00",
"description": "Aterm series products provided by NEC Corporation contain multiple vulnerabilities listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/862.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2026-4309\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/22.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://www.cve.org/CVERecord?id=CVE-2026-4619\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/78.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027http://www.cve.org/CVERecord?id=CVE-2026-4620\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027http://www.cve.org/CVERecord?id=CVE-2026-4622\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027https://cwe.mitre.org/data/definitions/912.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003ca href=\u0027http://www.cve.org/CVERecord?id=CVE-2026-4621\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eMissing authorization (CWE-862) - CVE-2026-4309\u003c/li\u003e\u003cli\u003ePath traversal (CWE-22) - CVE-2026-4619\u003c/li\u003e\u003cli\u003eOS command injection (CWE-78) - CVE-2026-4620, CVE-2026-4622\u003c/li\u003e\u003cli\u003eHidden functionality (CWE-912) - CVE-2026-4621\u003c/li\u003e\u003c/ul\u003eThe vulnerabilities are reported from the following people, and JPCERT/CC coordinated with the developer.\r\n\r\nCVE-2026-4309\r\nTaizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\n\r\nCVE-2026-4619, CVE-2026-4620, CVE-2026-4621, CVE-2026-4622\r\nChuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC.",
"link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000049.html",
"sec:cpe": {
"#text": "cpe:/o:nec:multiple_product",
"@product": "(multiple product)",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
"sec:identifier": "JVNDB-2026-000049",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN89339669/index.html",
"@id": "JVN#89339669",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-4309",
"@id": "CVE-2026-4309",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-4619",
"@id": "CVE-2026-4619",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-4620",
"@id": "CVE-2026-4620",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-4621",
"@id": "CVE-2026-4621",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2026-4622",
"@id": "CVE-2026-4622",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-22",
"@title": "Path Traversal(CWE-22)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in NEC Aterm series (NV26-001)"
}
JVNDB-2025-000107
Vulnerability from jvndb - Published: 2025-11-19 16:22 - Updated:2025-11-19 16:22
Severity
Summary
Installer of RakurakuMusen Start EX for Windows may insecurely load Dynamic Link Libraries
Details
Installer of RakurakuMusen Start EX for Windows provided by NEC Corporation uses an inappropriate DLL search path list, which may lead to insecurely loading Dynamic Link Libraries.
- Uncontrolled search path element (CWE-427) - CVE-2025-12852
References
| Type | URL | |
|---|---|---|
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000107.html",
"dc:date": "2025-11-19T16:22+09:00",
"dcterms:issued": "2025-11-19T16:22+09:00",
"dcterms:modified": "2025-11-19T16:22+09:00",
"description": "Installer of RakurakuMusen Start EX for Windows provided by NEC Corporation uses an inappropriate DLL search path list, which may lead to insecurely loading Dynamic Link Libraries.\u003cul\u003e\u003cli\u003eUncontrolled search path element (CWE-427) - CVE-2025-12852\u003c/li\u003e\u003c/ul\u003e",
"link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000107.html",
"sec:cpe": {
"#text": "cpe:/a:nec:rakuraku_wlanstart_ex",
"@product": "RakurakuMusen Start EX",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "7.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2025-000107",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN50288352/index.html",
"@id": "JVN#50288352",
"@source": "JVN"
},
{
"#text": "https://jvn.jp/en/ta/JVNTA91240916/",
"@id": "Japan Vulnerability Notes JVNTA#91240916",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-12852",
"@id": "CVE-2025-12852",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Installer of RakurakuMusen Start EX for Windows may insecurely load Dynamic Link Libraries"
}
JVNDB-2025-000102
Vulnerability from jvndb - Published: 2025-11-07 14:55 - Updated:2025-11-07 14:55
Severity
Summary
CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to OS command injection
Details
CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain the following vulnerability.
* OS command injection (CWE-78) - CVE-2025-11546
NEC Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Corporation coordinated under the Information Security Early Warning Partnership.
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000102.html",
"dc:date": "2025-11-07T14:55+09:00",
"dcterms:issued": "2025-11-07T14:55+09:00",
"dcterms:modified": "2025-11-07T14:55+09:00",
"description": "CLUSTERPRO X and EXPRESSCLUSTER X provided by NEC Corporation contain the following vulnerability.\r\n\r\n* OS command injection (CWE-78) - CVE-2025-11546\r\n\r\nNEC Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and NEC Corporation coordinated under the Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000102.html",
"sec:cpe": [
{
"#text": "cpe:/a:nec:clusterpro_x_misc",
"@product": "CLUSTERPRO X",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:nec:clusterpro_x_singleserversafe_misc",
"@product": "CLUSTERPRO X SingleServerSafe",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:nec:expresscluster_x",
"@product": "EXPRESSCLUSTER X",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:nec:expresscluster_x_singleserversafe",
"@product": "EXPRESSCLUSTER X SingleServerSafe",
"@vendor": "NEC Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "9.8",
"@severity": "Critical",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2025-000102",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN59387134/index.html",
"@id": "JVN#59387134",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-11546",
"@id": "CVE-2025-11546",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
}
],
"title": "CLUSTERPRO X and EXPRESSCLUSTER X vulnerable to OS command injection"
}
JVNDB-2025-000079
Vulnerability from jvndb - Published: 2025-09-18 17:43 - Updated:2025-09-18 17:43
Severity
Summary
UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation vulnerable to cross-site scripting
Details
UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contains the following vulnerability.
- Cross-site scripting (CWE-79) - CVE-2025-8153
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000079.html",
"dc:date": "2025-09-18T17:43+09:00",
"dcterms:issued": "2025-09-18T17:43+09:00",
"dcterms:modified": "2025-09-18T17:43+09:00",
"description": "UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contains the following vulnerability.\r\n\u003cul\u003e\u003cli\u003eCross-site scripting (CWE-79) - CVE-2025-8153\u003c/li\u003e\u003c/ul\u003e\r\nRyotaK of GMO Flatt Security Inc. reported this vulnerability to NEC Corporation and coordinated.\r\nAfter the coordination was completed, NEC Corporation reported the case to IPA to notify users of the solution through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000079.html",
"sec:cpe": {
"#text": "cpe:/o:nec:univerge",
"@product": "UNIVERGE",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "6.1",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2025-000079",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN95938761/index.html",
"@id": "JVN#95938761",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-8153",
"@id": "CVE-2025-8153",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation vulnerable to cross-site scripting"
}
JVNDB-2025-000002
Vulnerability from jvndb - Published: 2025-02-14 15:48 - Updated:2025-02-14 15:48
Severity
Summary
Multiple vulnerabilities in NEC Aterm series (NV25-003)
Details
Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below.
- Stored Cross-site Scripting (CWE-79) - CVE-2025-0354
- Missing Authentication for Critical Function (CWE-306) - CVE-2025-0355
- OOS Command Injection (CWE-78) - CVE-2025-0356
References
| Type | URL | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000002.html",
"dc:date": "2025-02-14T15:48+09:00",
"dcterms:issued": "2025-02-14T15:48+09:00",
"dcterms:modified": "2025-02-14T15:48+09:00",
"description": "Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\r\n\u003cli\u003eStored Cross-site Scripting (CWE-79) - CVE-2025-0354\u003c/li\u003e\r\n\u003cli\u003eMissing Authentication for Critical Function (CWE-306) - CVE-2025-0355\u003c/li\u003e\r\n\u003cli\u003eOOS Command Injection (CWE-78) - CVE-2025-0356\u003c/li\u003e\r\n\u003c/ul\u003e\r\n\r\nCVE-2025-0354, CVE-2025-0355\r\nTakayuki Sasaki and Katsunari Yoshioka of Yokohama National University reported these vulnerabilities to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.\r\n\r\nCVE-2025-0356\r\nKakeru Kajihara of NTT Security Holdings reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer.",
"link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000002.html",
"sec:cpe": [
{
"#text": "cpe:/o:nec:aterm_gb1200pe_firmware",
"@product": "Aterm GB1200PE firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wf1200cr_firmware",
"@product": "Aterm WF1200CR firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200cr_firmware",
"@product": "Aterm WG1200CR firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg2600hm4_firmware",
"@product": "Aterm WG2600HM4 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg2600hp4_firmware",
"@product": "Aterm WG2600HP4 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg2600hs2_firmware",
"@product": "Aterm WG2600HS2 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg2600hs_firmware",
"@product": "Aterm WG2600HS firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx1500hp_firmware",
"@product": "Aterm WX1500HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx3000hp_firmware",
"@product": "Aterm WX3000HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx3000hp_firmware",
"@product": "Aterm WX3000HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx3600hp_firmware",
"@product": "Aterm WX3600HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wx4200d5_firmware",
"@product": "Aterm WX4200D5 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "7.5",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2025-000002",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN65447879/index.html",
"@id": "JVN#65447879",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-0354",
"@id": "CVE-2025-0354",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-0355",
"@id": "CVE-2025-0355",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2025-0356",
"@id": "CVE-2025-0356",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in NEC Aterm series (NV25-003)"
}
JVNDB-2024-000124
Vulnerability from jvndb - Published: 2024-12-02 16:38 - Updated:2024-12-02 16:38
Severity
Summary
Multiple vulnerabilities in UNIVERGE IX/IX-R/IX-V series routers
Details
UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contain multiple vulnerabilities listed below.
- Command injection (CWE-77) - CVE-2024-11013
- Cross-site request forgery (WE-352) - CVE-2024-11014
References
| Type | URL | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000124.html",
"dc:date": "2024-12-02T16:38+09:00",
"dcterms:issued": "2024-12-02T16:38+09:00",
"dcterms:modified": "2024-12-02T16:38+09:00",
"description": "UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contain multiple vulnerabilities listed below.\r\n\u003cul\u003e\u003cli\u003eCommand injection (CWE-77) - CVE-2024-11013\u003c/li\u003e\u003cli\u003eCross-site request forgery (WE-352) - CVE-2024-11014\u003c/li\u003e\u003c/ul\u003e\r\n\r\nRyotaK of Flatt Security Inc. reported these vulnerabilities to NEC Corporation and coordinated. NEC Corporation and JPCERT/CC published respective advisories in order to notify users of the solutions through JVN.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000124.html",
"sec:cpe": {
"#text": "cpe:/o:nec:univerge",
"@product": "UNIVERGE",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
"sec:cvss": {
"@score": "7.2",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000124",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN53958863/index.html",
"@id": "JVN#53958863",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-11013",
"@id": "CVE-2024-11013",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-11014",
"@id": "CVE-2024-11014",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-352",
"@title": "Cross-Site Request Forgery(CWE-352)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in UNIVERGE IX/IX-R/IX-V series routers"
}
JVNDB-2024-000077
Vulnerability from jvndb - Published: 2024-07-30 16:40 - Updated:2024-07-30 16:40
Severity
Summary
FFRI AMC vulnerable to OS command injection
Details
FFRI AMC provided by FFRI Security, Inc. is a management console for the endpoint security product FFRI yarai and ActSecure X.
FFRI AMC contains an OS command injection vulnerability (CWE-78).
It is exploitable when the notification program setting is enabled, the executable file path is configured with a batch file (.bat) or command file (.cmd), and the file is written in a certain style.
FFRI Security, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and FFRI Security, Inc. coordinated under the Information Security Early Warning Partnership.
References
| Type | URL | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000077.html",
"dc:date": "2024-07-30T16:40+09:00",
"dcterms:issued": "2024-07-30T16:40+09:00",
"dcterms:modified": "2024-07-30T16:40+09:00",
"description": "FFRI AMC provided by FFRI Security, Inc. is a management console for the endpoint security product FFRI yarai and ActSecure X.\r\nFFRI AMC contains an OS command injection vulnerability (CWE-78).\r\nIt is exploitable when the notification program setting is enabled, the executable file path is configured with a batch file (.bat) or command file (.cmd), and the file is written in a certain style.\r\n\r\nFFRI Security, Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and FFRI Security, Inc. coordinated under the Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000077.html",
"sec:cpe": [
{
"#text": "cpe:/a:ffri:ffri_amc",
"@product": "FFRI AMC",
"@vendor": "FFRI Security, Inc.",
"@version": "2.2"
},
{
"#text": "cpe:/a:nec:ffri_amc",
"@product": "FFRI AMC for ActSecure X",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:skygroup:edr_plus_pack",
"@product": "EDR Pluspack",
"@vendor": "Sky Co., LTD.",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "8.1",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000077",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN26734798/index.html",
"@id": "JVN#26734798",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-40895",
"@id": "CVE-2024-40895",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
}
],
"title": "FFRI AMC vulnerable to OS command injection"
}
JVNDB-2024-003181
Vulnerability from jvndb - Published: 2024-05-10 13:59 - Updated:2024-05-10 13:59Summary
Hidden Functionality vulnerability in DT900
Details
DT900 contains a Hidden Functionality vulnerability(CWE-912). Specified versions allow an attacker to access the system setting.
reported by Mr. Gianluca Altomani and Mr. Manuel Romei. for NEC-PSIRT
References
| Type | URL | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | |
|---|---|---|
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003181.html",
"dc:date": "2024-05-10T13:59+09:00",
"dcterms:issued": "2024-05-10T13:59+09:00",
"dcterms:modified": "2024-05-10T13:59+09:00",
"description": "DT900 contains a Hidden Functionality vulnerability(CWE-912). Specified versions allow an attacker to access the system setting.\r\n\r\nreported by Mr. Gianluca Altomani and Mr. Manuel Romei. for NEC-PSIRT",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003181.html",
"sec:cpe": {
"#text": "cpe:/o:nec:dt900",
"@product": "DT900",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
"sec:identifier": "JVNDB-2024-003181",
"sec:references": [
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-3016",
"@id": "CVE-2024-3016",
"@source": "CVE"
},
{
"#text": "https://cwe.mitre.org/data/definitions/912.html",
"@id": "CWE-912",
"@title": "Hidden Functionality(CWE-912)"
}
],
"title": "Hidden Functionality vulnerability in DT900"
}
CVE-2025-12852 (GCVE-0-2025-12852)
Vulnerability from cvelistv5 – Published: 2025-11-19 01:01 – Updated: 2025-11-19 17:13
VLAI
Summary
DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | RakurakuMusen Start EX |
Affected:
All versions
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T17:13:04.376581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T17:13:10.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RakurakuMusen Start EX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kohei Kuroda"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user\u0027s device."
}
],
"value": "DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user\u0027s device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T01:01:46.374Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-007_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-12852",
"datePublished": "2025-11-19T01:01:46.374Z",
"dateReserved": "2025-11-07T04:30:21.085Z",
"dateUpdated": "2025-11-19T17:13:10.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11546 (GCVE-0-2025-11546)
Vulnerability from cvelistv5 – Published: 2025-11-07 01:09 – Updated: 2025-11-07 18:29
VLAI
Summary
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) |
Affected:
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
|
|
| NEC Corporation | CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux) |
Affected:
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-07T18:29:04.715150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-07T18:29:57.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "4.0, 4.1, 4.2, 5.0, 5.1 and 5.2"
}
]
},
{
"product": "CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux)",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "4.0, 4.1, 4.2, 5.0, 5.1 and 5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication."
}
],
"value": "CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-07T04:04:50.054Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-006_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-11546",
"datePublished": "2025-11-07T01:09:08.662Z",
"dateReserved": "2025-10-09T06:48:19.068Z",
"dateUpdated": "2025-11-07T18:29:57.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8153 (GCVE-0-2025-8153)
Vulnerability from cvelistv5 – Published: 2025-09-17 02:10 – Updated: 2025-09-17 13:45
VLAI
Summary
Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.9.5 to Ver.10.7
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.8.21 to Ver.10.8.36
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.9.11 to Ver.10.9.24
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6
|
|
| NEC Corporation | UNIVERGE IX-R/IX-V |
Affected:
Ver1.3.16, Ver1.3.21
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-17T13:44:45.472287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T13:45:14.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.9.5 to Ver.10.7"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.8.21 to Ver.10.8.36"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.9.11 to Ver.10.9.24"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX-R/IX-V",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver1.3.16, Ver1.3.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user\u0027s browser."
}
],
"value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user\u0027s browser."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T02:10:50.272Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-005_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-8153",
"datePublished": "2025-09-17T02:10:09.645Z",
"dateReserved": "2025-07-25T01:38:55.766Z",
"dateUpdated": "2025-09-17T13:45:14.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6466 (GCVE-0-2024-6466)
Vulnerability from cvelistv5 – Published: 2025-01-21 10:03 – Updated: 2025-01-21 19:43
VLAI
Summary
NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WebSAM DeploymentManager |
Affected:
from v6.0 to v6.80
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-6466",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-21T19:20:47.843701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T19:43:54.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WebSAM DeploymentManager",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from v6.0 to v6.80"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NEC Corporation\u0027s WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified."
}
],
"value": "NEC Corporation\u0027s WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T10:03:24.544Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv15-019_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-6466",
"datePublished": "2025-01-21T10:03:24.544Z",
"dateReserved": "2024-07-03T00:18:49.513Z",
"dateUpdated": "2025-01-21T19:43:54.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0356 (GCVE-0-2025-0356)
Vulnerability from cvelistv5 – Published: 2025-01-15 07:24 – Updated: 2025-04-03 15:36
VLAI
Summary
NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WX1500HP |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WX3600HP |
Affected:
Ver.1.5.3 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T15:36:52.964723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T15:36:59.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WX1500HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3600HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.5.3 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kakeru Kajihara of NTT Security Holdings."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network."
}
],
"value": "NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-17T10:02:45.212Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0356",
"datePublished": "2025-01-15T07:24:25.831Z",
"dateReserved": "2025-01-09T06:20:51.166Z",
"dateUpdated": "2025-04-03T15:36:59.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0355 (GCVE-0-2025-0355)
Vulnerability from cvelistv5 – Published: 2025-01-15 07:23 – Updated: 2025-01-21 03:34
VLAI
Summary
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WG2600HS |
Affected:
Ver.1.7.2 and earlier
|
|
| NEC Corporation | WF1200CR |
Affected:
Ver.1.6.0 and earlier
|
|
| NEC Corporation | WG1200CR |
Affected:
Ver.1.5.0 and earlier
|
|
| NEC Corporation | GB1200PE |
Affected:
Ver.1.3.0 and earlier
|
|
| NEC Corporation | WG2600HP4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HM4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HS2 |
Affected:
Ver.1.3.2 and earlier
|
|
| NEC Corporation | WX3000HP |
Affected:
Ver.2.4.2 and earlier
|
|
| NEC Corporation | WX4200D5 |
Affected:
Ver.1.2.4 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-15T15:01:29.278695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T15:01:48.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WG2600HS",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.7.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WF1200CR",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.6.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG1200CR",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.5.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "GB1200PE",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HP4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HM4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HS2",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3000HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.2.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX4200D5",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.2.4 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
}
],
"value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T03:34:13.440Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0355",
"datePublished": "2025-01-15T07:23:39.481Z",
"dateReserved": "2025-01-09T06:20:49.647Z",
"dateUpdated": "2025-01-21T03:34:13.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0354 (GCVE-0-2025-0354)
Vulnerability from cvelistv5 – Published: 2025-01-15 07:21 – Updated: 2025-04-03 15:38
VLAI
Summary
Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WG2600HS |
Affected:
Ver.1.7.2 and earlier
|
|
| NEC Corporation | WG2600HP4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HM4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HS2 |
Affected:
Ver.1.3.2 and earlier
|
|
| NEC Corporation | WX3000HP |
Affected:
Ver.2.4.2 and earlier
|
|
| NEC Corporation | WX4200D5 |
Affected:
Ver.1.2.4 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0354",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T15:37:52.480740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T15:38:02.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WG2600HS",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.7.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HP4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HM4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HS2",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3000HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.2.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX4200D5",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.2.4 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network."
}
],
"value": "Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-17T10:02:08.927Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0354",
"datePublished": "2025-01-15T07:21:41.810Z",
"dateReserved": "2025-01-09T06:20:47.803Z",
"dateUpdated": "2025-04-03T15:38:02.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11014 (GCVE-0-2024-11014)
Vulnerability from cvelistv5 – Published: 2024-11-29 08:06 – Updated: 2025-07-24 14:37
VLAI
Summary
Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver9.2 to Ver10.10.21
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.8 up to Ver10.8.27
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.9 up to Ver10.9.14
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:33:02.584725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:37:20.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver9.2 to Ver10.10.21"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.8 up to Ver10.8.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.9 up to Ver10.9.14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T07:22:49.583Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-11014",
"datePublished": "2024-11-29T08:06:19.712Z",
"dateReserved": "2024-11-08T02:59:57.594Z",
"dateUpdated": "2025-07-24T14:37:20.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11013 (GCVE-0-2024-11013)
Vulnerability from cvelistv5 – Published: 2024-11-29 08:03 – Updated: 2025-07-24 14:40
VLAI
Summary
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver9.2 to Ver10.10.21
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.8 up to Ver10.8.27
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.9 up to Ver10.9.14
|
|
| NEC Corporation | UNIVERGE IX-R/IX-V |
Affected:
Ver1.2.15 and earlier
|
|
| nec | univerge_ix |
Affected:
9.2 , ≤ 10.10.21
(custom)
Affected: 10.8 , ≤ 10.8.27 (custom) Affected: 10.9 , ≤ 10.9.14 (custom) cpe:2.3:a:nec:univerge_ix:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:nec:univerge_ix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "univerge_ix",
"vendor": "nec",
"versions": [
{
"lessThanOrEqual": "10.10.21",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.8.27",
"status": "affected",
"version": "10.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.9.14",
"status": "affected",
"version": "10.9",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:34:19.048337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:40:37.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver9.2 to Ver10.10.21"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.8 up to Ver10.8.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.9 up to Ver10.9.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX-R/IX-V",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver1.2.15 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface."
}
],
"value": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T07:21:57.134Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-11013",
"datePublished": "2024-11-29T08:03:07.458Z",
"dateReserved": "2024-11-08T02:59:55.534Z",
"dateUpdated": "2025-07-24T14:40:37.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-40895 (GCVE-0-2024-40895)
Vulnerability from cvelistv5 – Published: 2024-07-30 08:37 – Updated: 2024-08-02 04:39
VLAI
Summary
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS command injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| FFRI Security, Inc. | FFRI AMC |
Affected:
3.4.0 to 3.5.3
|
|
| NEC Corporation | FFRI AMC for ActSecure χ |
Affected:
3.4.0 to 3.5.3
|
|
| Sky Co., Ltd. | EDR Plus Pack |
Affected:
Bundled FFRI AMC versions 3.4.0 to 3.5.3
|
|
| ffri | ffri_amc |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:ffri:ffri_amc:3.4.0:*:*:*:*:*:*:* |
|
| skygroup | edr_plus_pack |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:skygroup:edr_plus_pack:3.4.0:*:*:*:*:*:*:* |
|
| skygroup | edr_plus_pack_cloud |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:skygroup:edr_plus_pack_cloud:3.4.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ffri:ffri_amc:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ffri_amc",
"vendor": "ffri",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:skygroup:edr_plus_pack:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edr_plus_pack",
"vendor": "skygroup",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:skygroup:edr_plus_pack_cloud:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edr_plus_pack_cloud",
"vendor": "skygroup",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-40895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-30T14:16:27.684515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T17:31:56.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:39:55.373Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ffri.jp/assets/files/other_docs/20240729.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.support.nec.co.jp/View.aspx?id=3140109694"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.skyseaclientview.net/news/240729_01/"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN26734798/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FFRI AMC",
"vendor": "FFRI Security, Inc.",
"versions": [
{
"status": "affected",
"version": "3.4.0 to 3.5.3"
}
]
},
{
"product": "FFRI AMC for ActSecure \u03c7",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "3.4.0 to 3.5.3"
}
]
},
{
"product": "EDR Plus Pack",
"vendor": "Sky Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "Bundled FFRI AMC versions 3.4.0 to 3.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T08:37:07.607Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.ffri.jp/assets/files/other_docs/20240729.pdf"
},
{
"url": "https://www.support.nec.co.jp/View.aspx?id=3140109694"
},
{
"url": "https://www.skyseaclientview.net/news/240729_01/"
},
{
"url": "https://jvn.jp/en/jp/JVN26734798/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-40895",
"datePublished": "2024-07-30T08:37:07.607Z",
"dateReserved": "2024-07-12T03:00:58.480Z",
"dateUpdated": "2024-08-02T04:39:55.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-12852 (GCVE-0-2025-12852)
Vulnerability from nvd – Published: 2025-11-19 01:01 – Updated: 2025-11-19 17:13
VLAI
Summary
DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | RakurakuMusen Start EX |
Affected:
All versions
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12852",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-19T17:13:04.376581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T17:13:10.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "RakurakuMusen Start EX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kohei Kuroda"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user\u0027s device."
}
],
"value": "DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user\u0027s device."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-19T01:01:46.374Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-007_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-12852",
"datePublished": "2025-11-19T01:01:46.374Z",
"dateReserved": "2025-11-07T04:30:21.085Z",
"dateUpdated": "2025-11-19T17:13:10.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11546 (GCVE-0-2025-11546)
Vulnerability from nvd – Published: 2025-11-07 01:09 – Updated: 2025-11-07 18:29
VLAI
Summary
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) |
Affected:
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
|
|
| NEC Corporation | CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux) |
Affected:
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-07T18:29:04.715150Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-07T18:29:57.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "4.0, 4.1, 4.2, 5.0, 5.1 and 5.2"
}
]
},
{
"product": "CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux)",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "4.0, 4.1, 4.2, 5.0, 5.1 and 5.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication."
}
],
"value": "CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-07T04:04:50.054Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-006_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-11546",
"datePublished": "2025-11-07T01:09:08.662Z",
"dateReserved": "2025-10-09T06:48:19.068Z",
"dateUpdated": "2025-11-07T18:29:57.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8153 (GCVE-0-2025-8153)
Vulnerability from nvd – Published: 2025-09-17 02:10 – Updated: 2025-09-17 13:45
VLAI
Summary
Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.9.5 to Ver.10.7
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.8.21 to Ver.10.8.36
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.9.11 to Ver.10.9.24
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6
|
|
| NEC Corporation | UNIVERGE IX-R/IX-V |
Affected:
Ver1.3.16, Ver1.3.21
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-17T13:44:45.472287Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T13:45:14.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.9.5 to Ver.10.7"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.8.21 to Ver.10.8.36"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.9.11 to Ver.10.9.24"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX-R/IX-V",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver1.3.16, Ver1.3.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user\u0027s browser."
}
],
"value": "Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user\u0027s browser."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T02:10:50.272Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-005_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-8153",
"datePublished": "2025-09-17T02:10:09.645Z",
"dateReserved": "2025-07-25T01:38:55.766Z",
"dateUpdated": "2025-09-17T13:45:14.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-6466 (GCVE-0-2024-6466)
Vulnerability from nvd – Published: 2025-01-21 10:03 – Updated: 2025-01-21 19:43
VLAI
Summary
NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1021 - Improper Restriction of Rendered UI Layers or Frames
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WebSAM DeploymentManager |
Affected:
from v6.0 to v6.80
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-6466",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-21T19:20:47.843701Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T19:43:54.175Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WebSAM DeploymentManager",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from v6.0 to v6.80"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NEC Corporation\u0027s WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified."
}
],
"value": "NEC Corporation\u0027s WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1021",
"description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T10:03:24.544Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv15-019_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-6466",
"datePublished": "2025-01-21T10:03:24.544Z",
"dateReserved": "2024-07-03T00:18:49.513Z",
"dateUpdated": "2025-01-21T19:43:54.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0356 (GCVE-0-2025-0356)
Vulnerability from nvd – Published: 2025-01-15 07:24 – Updated: 2025-04-03 15:36
VLAI
Summary
NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WX1500HP |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WX3600HP |
Affected:
Ver.1.5.3 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T15:36:52.964723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T15:36:59.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WX1500HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3600HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.5.3 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Kakeru Kajihara of NTT Security Holdings."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network."
}
],
"value": "NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-17T10:02:45.212Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0356",
"datePublished": "2025-01-15T07:24:25.831Z",
"dateReserved": "2025-01-09T06:20:51.166Z",
"dateUpdated": "2025-04-03T15:36:59.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0355 (GCVE-0-2025-0355)
Vulnerability from nvd – Published: 2025-01-15 07:23 – Updated: 2025-01-21 03:34
VLAI
Summary
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WG2600HS |
Affected:
Ver.1.7.2 and earlier
|
|
| NEC Corporation | WF1200CR |
Affected:
Ver.1.6.0 and earlier
|
|
| NEC Corporation | WG1200CR |
Affected:
Ver.1.5.0 and earlier
|
|
| NEC Corporation | GB1200PE |
Affected:
Ver.1.3.0 and earlier
|
|
| NEC Corporation | WG2600HP4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HM4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HS2 |
Affected:
Ver.1.3.2 and earlier
|
|
| NEC Corporation | WX3000HP |
Affected:
Ver.2.4.2 and earlier
|
|
| NEC Corporation | WX4200D5 |
Affected:
Ver.1.2.4 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-15T15:01:29.278695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-15T15:01:48.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WG2600HS",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.7.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WF1200CR",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.6.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG1200CR",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.5.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "GB1200PE",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.0 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HP4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HM4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HS2",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3000HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.2.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX4200D5",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.2.4 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
}
],
"value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-21T03:34:13.440Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0355",
"datePublished": "2025-01-15T07:23:39.481Z",
"dateReserved": "2025-01-09T06:20:49.647Z",
"dateUpdated": "2025-01-21T03:34:13.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0354 (GCVE-0-2025-0354)
Vulnerability from nvd – Published: 2025-01-15 07:21 – Updated: 2025-04-03 15:38
VLAI
Summary
Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | WG2600HS |
Affected:
Ver.1.7.2 and earlier
|
|
| NEC Corporation | WG2600HP4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HM4 |
Affected:
Ver.1.4.2 and earlier
|
|
| NEC Corporation | WG2600HS2 |
Affected:
Ver.1.3.2 and earlier
|
|
| NEC Corporation | WX3000HP |
Affected:
Ver.2.4.2 and earlier
|
|
| NEC Corporation | WX4200D5 |
Affected:
Ver.1.2.4 and earlier
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0354",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-03T15:37:52.480740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-03T15:38:02.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WG2600HS",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.7.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HP4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HM4",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WG2600HS2",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.3.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX3000HP",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.2.4.2 and earlier"
}
]
},
{
"defaultStatus": "unknown",
"product": "WX4200D5",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.2.4 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network."
}
],
"value": "Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-17T10:02:08.927Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2025-0354",
"datePublished": "2025-01-15T07:21:41.810Z",
"dateReserved": "2025-01-09T06:20:47.803Z",
"dateUpdated": "2025-04-03T15:38:02.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11014 (GCVE-0-2024-11014)
Vulnerability from nvd – Published: 2024-11-29 08:06 – Updated: 2025-07-24 14:37
VLAI
Summary
Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver9.2 to Ver10.10.21
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.8 up to Ver10.8.27
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.9 up to Ver10.9.14
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11014",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:33:02.584725Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:37:20.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver9.2 to Ver10.10.21"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.8 up to Ver10.8.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.9 up to Ver10.9.14"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface."
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T07:22:49.583Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-11014",
"datePublished": "2024-11-29T08:06:19.712Z",
"dateReserved": "2024-11-08T02:59:57.594Z",
"dateUpdated": "2025-07-24T14:37:20.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11013 (GCVE-0-2024-11013)
Vulnerability from nvd – Published: 2024-11-29 08:03 – Updated: 2025-07-24 14:40
VLAI
Summary
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| NEC Corporation | UNIVERGE IX |
Affected:
from Ver9.2 to Ver10.10.21
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.8 up to Ver10.8.27
|
|
| NEC Corporation | UNIVERGE IX |
Affected:
for Ver10.9 up to Ver10.9.14
|
|
| NEC Corporation | UNIVERGE IX-R/IX-V |
Affected:
Ver1.2.15 and earlier
|
|
| nec | univerge_ix |
Affected:
9.2 , ≤ 10.10.21
(custom)
Affected: 10.8 , ≤ 10.8.27 (custom) Affected: 10.9 , ≤ 10.9.14 (custom) cpe:2.3:a:nec:univerge_ix:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:nec:univerge_ix:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "univerge_ix",
"vendor": "nec",
"versions": [
{
"lessThanOrEqual": "10.10.21",
"status": "affected",
"version": "9.2",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.8.27",
"status": "affected",
"version": "10.8",
"versionType": "custom"
},
{
"lessThanOrEqual": "10.9.14",
"status": "affected",
"version": "10.9",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11013",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:34:19.048337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-24T14:40:37.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "from Ver9.2 to Ver10.10.21"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.8 up to Ver10.8.27"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "for Ver10.9 up to Ver10.9.14"
}
]
},
{
"defaultStatus": "unknown",
"product": "UNIVERGE IX-R/IX-V",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "Ver1.2.15 and earlier"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"user": "00000000-0000-4000-9000-000000000000",
"value": "RyotaK of Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface."
}
],
"value": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-23T07:21:57.134Z",
"orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"shortName": "NEC"
},
"references": [
{
"url": "https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
"assignerShortName": "NEC",
"cveId": "CVE-2024-11013",
"datePublished": "2024-11-29T08:03:07.458Z",
"dateReserved": "2024-11-08T02:59:55.534Z",
"dateUpdated": "2025-07-24T14:40:37.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-40895 (GCVE-0-2024-40895)
Vulnerability from nvd – Published: 2024-07-30 08:37 – Updated: 2024-08-02 04:39
VLAI
Summary
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- OS command injection
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| FFRI Security, Inc. | FFRI AMC |
Affected:
3.4.0 to 3.5.3
|
|
| NEC Corporation | FFRI AMC for ActSecure χ |
Affected:
3.4.0 to 3.5.3
|
|
| Sky Co., Ltd. | EDR Plus Pack |
Affected:
Bundled FFRI AMC versions 3.4.0 to 3.5.3
|
|
| ffri | ffri_amc |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:ffri:ffri_amc:3.4.0:*:*:*:*:*:*:* |
|
| skygroup | edr_plus_pack |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:skygroup:edr_plus_pack:3.4.0:*:*:*:*:*:*:* |
|
| skygroup | edr_plus_pack_cloud |
Affected:
3.4.0 , < 3.5.3
(custom)
cpe:2.3:a:skygroup:edr_plus_pack_cloud:3.4.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ffri:ffri_amc:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ffri_amc",
"vendor": "ffri",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:skygroup:edr_plus_pack:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edr_plus_pack",
"vendor": "skygroup",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:skygroup:edr_plus_pack_cloud:3.4.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "edr_plus_pack_cloud",
"vendor": "skygroup",
"versions": [
{
"lessThan": "3.5.3",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-40895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-30T14:16:27.684515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-31T17:31:56.655Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:39:55.373Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.ffri.jp/assets/files/other_docs/20240729.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.support.nec.co.jp/View.aspx?id=3140109694"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.skyseaclientview.net/news/240729_01/"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN26734798/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FFRI AMC",
"vendor": "FFRI Security, Inc.",
"versions": [
{
"status": "affected",
"version": "3.4.0 to 3.5.3"
}
]
},
{
"product": "FFRI AMC for ActSecure \u03c7",
"vendor": "NEC Corporation",
"versions": [
{
"status": "affected",
"version": "3.4.0 to 3.5.3"
}
]
},
{
"product": "EDR Plus Pack",
"vendor": "Sky Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "Bundled FFRI AMC versions 3.4.0 to 3.5.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T08:37:07.607Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.ffri.jp/assets/files/other_docs/20240729.pdf"
},
{
"url": "https://www.support.nec.co.jp/View.aspx?id=3140109694"
},
{
"url": "https://www.skyseaclientview.net/news/240729_01/"
},
{
"url": "https://jvn.jp/en/jp/JVN26734798/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-40895",
"datePublished": "2024-07-30T08:37:07.607Z",
"dateReserved": "2024-07-12T03:00:58.480Z",
"dateUpdated": "2024-08-02T04:39:55.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}