JVN#38248512: Multiple vulnerabilities in Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2

Aterm WF800HP, Aterm WG2600HP, and Aterm WG2600HP2 provided by NEC Corporation contain multiple vulnerabilities listed below.

Aterm WF800HP:

Cross-site Scripting (CWE-79) - CVE-2021-20620

**Aterm WG2600HP and Aterm WG2600HP2:**Improper Access Control (CWE-284) - CVE-2017-12575

Cross-Site Request Forgery (CWE-352) - CVE-2021-20621

Cross-site Scripting (CWE-79) - CVE-2021-20622

Impact

• An arbitrary script may be executed on the user’s web browser - CVE-2021-20620
• A remote attacker may obtain and/or alter the settings stored in the device - CVE-2017-12575
• If a user accesses a specially crafted page while logged in, unintended operations may be performed - CVE-2021-20621
• An arbitrary script may be executed on the logged in user’s web browser - CVE-2021-20622

Solution

Apply workaround For the users of Aterm WF800HP:
Applying the following workaround may mitigate the impacts of the vulnerability.

• When accessing a website, use a URL obtained from a trusted source and register it to the bookmark. For subsequent accesses, use the URL registered in the bookmark.
  Update the firmware For the users of Aterm WG2600HP and Aterm WG2600HP2:
  Update the firmware to the latest version according to the information provided by the developer.

Products Affected

• Aterm WF800HP firmware all versions
• Aterm WG2600HP firmware Ver1.0.13 and earlier
• Aterm WG2600HP2 firmware Ver1.0.3 and earlier