github - ghsa-872h-pcfc-25m6

GHSA-872H-PCFC-25M6

Vulnerability from github – Published: 2025-01-15 09:30 – Updated: 2025-01-15 09:30

Details

Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the internet.

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-0355"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-15T08:15:26Z",
    "severity": "HIGH"
  },
  "details": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the internet.",
  "id": "GHSA-872h-pcfc-25m6",
  "modified": "2025-01-15T09:30:50Z",
  "published": "2025-01-15T09:30:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0355"
    },
    {
      "type": "WEB",
      "url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-0355 (GCVE-0-2025-0355)

Vulnerability from cvelistv5 – Published: 2025-01-15 07:23 – Updated: 2025-01-21 03:34

Summary

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-306 - Missing Authentication for Critical Function

Assigner

NEC

References

URL

Tags

https://jpn.nec.com/security-info/secinfo/nv25-00…

Impacted products

Vendor

Product

Version

NEC Corporation

WG2600HS

Affected: Ver.1.7.2 and earlier

NEC Corporation	WF1200CR	Affected: Ver.1.6.0 and earlier
NEC Corporation	WG1200CR	Affected: Ver.1.5.0 and earlier
NEC Corporation	GB1200PE	Affected: Ver.1.3.0 and earlier
NEC Corporation	WG2600HP4	Affected: Ver.1.4.2 and earlier
NEC Corporation	WG2600HM4	Affected: Ver.1.4.2 and earlier
NEC Corporation	WG2600HS2	Affected: Ver.1.3.2 and earlier
NEC Corporation	WX3000HP	Affected: Ver.2.4.2 and earlier
NEC Corporation	WX4200D5	Affected: Ver.1.2.4 and earlier

Credits

Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-15T15:01:29.278695Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-15T15:01:48.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "WG2600HS",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.7.2 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WF1200CR",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.6.0 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WG1200CR",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.5.0 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "GB1200PE",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.3.0 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WG2600HP4",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.4.2 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WG2600HM4",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.4.2 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WG2600HS2",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.3.2 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WX3000HP",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.2.4.2 and earlier"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "WX4200D5",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.2.4 and earlier"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Takayuki Sasaki and Katsunari Yoshioka of Yokohama National University."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
            }
          ],
          "value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-21T03:34:13.440Z",
        "orgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
        "shortName": "NEC"
      },
      "references": [
        {
          "url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f2760a35-e0d8-4637-ac4c-cc1a2de3e282",
    "assignerShortName": "NEC",
    "cveId": "CVE-2025-0355",
    "datePublished": "2025-01-15T07:23:39.481Z",
    "dateReserved": "2025-01-09T06:20:49.647Z",
    "dateUpdated": "2025-01-21T03:34:13.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-872H-PCFC-25M6

CVE-2025-0355 (GCVE-0-2025-0355)

Tags

Sightings

Nomenclature