jvndb-2021-000028
Vulnerability from jvndb
Published
2021-04-09 17:16
Modified
2021-04-09 17:16
Severity ?
Summary
Multiple vulnerabilities in multiple Aterm products
Details
Multiple Aterm products provided by NEC Corporation contain multiple vulnerabilities listed below.
*Cross-site Scripting (CWE-79) - CVE-2021-20680
*OS command injection via UPnP (CWE-78) - CVE-2014-8361
CVE-2021-20680
Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVE-2014-8361
Satoru Nagaoka of Cyber Defense Institute, Inc, Katsuhiko Sato (a.k.a. goroh_kun) and Ryo Kashiro of 00One, Inc. and Rintaro Fujita of Nippon Telegraph and Telephone Corporation reported to IPA that CVE-2014-8361 vulnerability still exists in NEC Corporation products. JPCERT/CC coordinated with the developer.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000028.html",
"dc:date": "2021-04-09T17:16+09:00",
"dcterms:issued": "2021-04-09T17:16+09:00",
"dcterms:modified": "2021-04-09T17:16+09:00",
"description": "Multiple Aterm products provided by NEC Corporation contain multiple vulnerabilities listed below.\r\n\r\n*Cross-site Scripting (CWE-79) - CVE-2021-20680\r\n*OS command injection via UPnP (CWE-78) - CVE-2014-8361\r\n\r\nCVE-2021-20680\r\nToshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.\r\n\r\nCVE-2014-8361\r\nSatoru Nagaoka of Cyber Defense Institute, Inc, Katsuhiko Sato (a.k.a. goroh_kun) and Ryo Kashiro of 00One, Inc. and Rintaro Fujita of Nippon Telegraph and Telephone Corporation reported to IPA that CVE-2014-8361 vulnerability still exists in NEC Corporation products. JPCERT/CC coordinated with the developer.",
"link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-000028.html",
"sec:cpe": [
{
"#text": "cpe:/o:nec:aterm_w1200ex-ms_firmware",
"@product": "Aterm W1200EX-MS firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_w1200ex_firmware",
"@product": "Aterm W1200EX firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_w300p_firmware",
"@product": "Aterm W300P firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_w500p_firmware",
"@product": "Aterm W500P firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wf300hp2_firmware",
"@product": "Aterm WF300HP2 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wf800hp_firmware",
"@product": "Aterm WF800HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hp2_firmware",
"@product": "Aterm WG1200HP2 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hp3_firmware",
"@product": "Aterm WG1200HP3 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hp_firmware",
"@product": "Aterm WG1200HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hs2_firmware",
"@product": "Aterm WG1200HS2 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hs3_firmware",
"@product": "Aterm WG1200HS3 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1200hs_firmware",
"@product": "Aterm WG1200HS firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1800hp3_firmware",
"@product": "Aterm WG1800HP3 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1800hp4_firmware",
"@product": "Aterm WG1800HP4 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1900hp2_firmware",
"@product": "Aterm WG1900HP2 firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wg1900hp_firmware",
"@product": "Aterm WG1900HP firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/o:nec:aterm_wr8165n_firmware",
"@product": "Aterm WR8165N firmware",
"@vendor": "NEC Corporation",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "5.8",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"@version": "2.0"
},
{
"@score": "8.8",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2021-000028",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN67456944/index.html",
"@id": "JVN#67456944",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8361",
"@id": "CVE-2014-8361",
"@source": "CVE"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20680",
"@id": "CVE-2021-20680",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2014-8361",
"@id": "CVE-2014-8361",
"@source": "NVD"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20680",
"@id": "CVE-2021-20680",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-78",
"@title": "OS Command Injection(CWE-78)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "Multiple vulnerabilities in multiple Aterm products"
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.