jvndb - jvndb-2021-000006

jvndb-2021-000006

Vulnerability from jvndb

Published

2021-01-22 17:55

Modified

2021-02-03 12:05

Severity ?

7.5 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2

Details

Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities. Aterm WF800HP: *Cross-site Scripting (CWE-79) - CVE-2021-20620 Aterm WG2600HP and Aterm WG2600HP2: *Improper Access Control (CWE-284) - CVE-2017-12575 *Cross-Site Request Forgery (CWE-352) - CVE-2021-20621 *Cross-site Scripting (CWE-79) - CVE-2021-20622 CVE-2021-20620 Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. CVE-2021-20621, CVE-2021-20622 Noriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN38248512/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12575
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20620
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20621
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20622
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20620
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20621
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20622
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2017-12575
	Permissions(CWE-264)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-Site Request Forgery(CWE-352)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	NEC Corporation	Aterm WF800HP firmware
	NEC Corporation	Aterm WG2600HP2 firmware
	NEC Corporation	Aterm WG2600HP firmware

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000006.html",
  "dc:date": "2021-02-03T12:05+09:00",
  "dcterms:issued": "2021-01-22T17:55+09:00",
  "dcterms:modified": "2021-02-03T12:05+09:00",
  "description": "Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities.\r\n\r\nAterm WF800HP:\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20620\r\n\r\nAterm WG2600HP and Aterm WG2600HP2:\r\n*Improper Access Control (CWE-284) - CVE-2017-12575\r\n*Cross-Site Request Forgery (CWE-352) - CVE-2021-20621\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20622\r\n\r\nCVE-2021-20620\r\nSatoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2021-20621, CVE-2021-20622\r\nNoriaki Iwasaki of Cyber Defense Institute, Inc. reported these vulnerabilities to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000006.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:nec:aterm_wf800hp_firmware",
      "@product": "Aterm WF800HP firmware",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nec:aterm_wg2600hp2_firmware",
      "@product": "Aterm WG2600HP2 firmware",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:nec:aterm_wg2600hp_firmware",
      "@product": "Aterm WG2600HP firmware",
      "@vendor": "NEC Corporation",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "7.5",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2021-000006",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN38248512/index.html",
      "@id": "JVN#38248512",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12575",
      "@id": "CVE-2017-12575",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20620",
      "@id": "CVE-2021-20620",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20621",
      "@id": "CVE-2021-20621",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20622",
      "@id": "CVE-2021-20622",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20620",
      "@id": "CVE-2021-20620",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20621",
      "@id": "CVE-2021-20621",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20622",
      "@id": "CVE-2021-20622",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2017-12575",
      "@id": "CVE-2017-12575",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-264",
      "@title": "Permissions(CWE-264)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-352",
      "@title": "Cross-Site Request Forgery(CWE-352)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2"
}

cve-2021-20620

Vulnerability from cvelistv5

Published

2021-01-28 10:00

Modified

2024-08-03 17:45

Severity ?

Summary

Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

References

▼	URL	Tags
	https://www.aterm.jp/support/tech/2019/0328.html	x_refsource_MISC
	https://jpn.nec.com/security-info/secinfo/nv21-005.html	x_refsource_MISC
	https://jvn.jp/en/jp/JVN38248512/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	NEC Corporation	Aterm WF800HP

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:44.757Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.aterm.jp/support/tech/2019/0328.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Aterm WF800HP",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Aterm WF800HP firmware Ver1.0.9 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-28T10:00:28",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aterm.jp/support/tech/2019/0328.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20620",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Aterm WF800HP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Aterm WF800HP firmware Ver1.0.9 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NEC Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.aterm.jp/support/tech/2019/0328.html",
              "refsource": "MISC",
              "url": "https://www.aterm.jp/support/tech/2019/0328.html"
            },
            {
              "name": "https://jpn.nec.com/security-info/secinfo/nv21-005.html",
              "refsource": "MISC",
              "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN38248512/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20620",
    "datePublished": "2021-01-28T10:00:28",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:44.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20622

Vulnerability from cvelistv5

Published

2021-01-28 10:00

Modified

2024-08-03 17:45

Severity ?

Summary

Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.

References

▼	URL	Tags
	https://www.aterm.jp/support/tech/2019/0328.html	x_refsource_MISC
	https://jpn.nec.com/security-info/secinfo/nv21-005.html	x_refsource_MISC
	https://jvn.jp/en/jp/JVN38248512/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	NEC Corporation	Aterm WG2600HP and Aterm WG2600HP2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:44.887Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.aterm.jp/support/tech/2019/0328.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Aterm WG2600HP and Aterm WG2600HP2",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-28T10:00:29",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aterm.jp/support/tech/2019/0328.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20622",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Aterm WG2600HP and Aterm WG2600HP2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NEC Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.aterm.jp/support/tech/2019/0328.html",
              "refsource": "MISC",
              "url": "https://www.aterm.jp/support/tech/2019/0328.html"
            },
            {
              "name": "https://jpn.nec.com/security-info/secinfo/nv21-005.html",
              "refsource": "MISC",
              "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN38248512/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20622",
    "datePublished": "2021-01-28T10:00:29",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:44.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20621

Vulnerability from cvelistv5

Published

2021-01-28 10:00

Modified

2024-08-03 17:45

Severity ?

Summary

Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

References

▼	URL	Tags
	https://www.aterm.jp/support/tech/2019/0328.html	x_refsource_MISC
	https://jpn.nec.com/security-info/secinfo/nv21-005.html	x_refsource_MISC
	https://jvn.jp/en/jp/JVN38248512/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	NEC Corporation	Aterm WG2600HP and Aterm WG2600HP2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:44.833Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.aterm.jp/support/tech/2019/0328.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Aterm WG2600HP and Aterm WG2600HP2",
          "vendor": "NEC Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-28T10:00:29",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.aterm.jp/support/tech/2019/0328.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20621",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Aterm WG2600HP and Aterm WG2600HP2",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "NEC Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site request forgery"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.aterm.jp/support/tech/2019/0328.html",
              "refsource": "MISC",
              "url": "https://www.aterm.jp/support/tech/2019/0328.html"
            },
            {
              "name": "https://jpn.nec.com/security-info/secinfo/nv21-005.html",
              "refsource": "MISC",
              "url": "https://jpn.nec.com/security-info/secinfo/nv21-005.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN38248512/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN38248512/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20621",
    "datePublished": "2021-01-28T10:00:29",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:44.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2017-12575

Vulnerability from cvelistv5

Published

2018-08-24 19:00

Modified

2024-08-05 18:43

Severity ?

Summary

An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d "REQ_ID=SUPPORT_IF_GET").

References

▼	URL	Tags
	http://seclists.org/fulldisclosure/2018/Aug/26	mailing-list, x_refsource_FULLDISC
	http://jvn.jp/en/jp/JVN38248512/index.html	third-party-advisory, x_refsource_JVN

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:43:56.136Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180821 CVE-2017-12575: information leakage in NEC Aterm WG2600HP2",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Aug/26"
          },
          {
            "name": "JVN#38248512",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/en/jp/JVN38248512/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don\u0027t require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d \"REQ_ID=SUPPORT_IF_GET\")."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-22T06:06:12",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20180821 CVE-2017-12575: information leakage in NEC Aterm WG2600HP2",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Aug/26"
        },
        {
          "name": "JVN#38248512",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/en/jp/JVN38248512/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-12575",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don\u0027t require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d \"REQ_ID=SUPPORT_IF_GET\")."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180821 CVE-2017-12575: information leakage in NEC Aterm WG2600HP2",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Aug/26"
            },
            {
              "name": "JVN#38248512",
              "refsource": "JVN",
              "url": "http://jvn.jp/en/jp/JVN38248512/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-12575",
    "datePublished": "2018-08-24T19:00:00",
    "dateReserved": "2017-08-05T00:00:00",
    "dateUpdated": "2024-08-05T18:43:56.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2021-000006

Vulnerability from jvndb

cve-2021-20620

Vulnerability from cvelistv5

cve-2021-20622

Vulnerability from cvelistv5

cve-2021-20621

Vulnerability from cvelistv5

cve-2017-12575

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature