JVN#38343415: Multiple vulnerabilities in Aterm series

Aterm series provided by NEC Corporation contain multiple vulnerabilities listed below.

Directory traversal (CWE-22) - CVE-2023-3330

Directory traversal (CWE-22) - CVE-2023-3331

Stored cross-site scripting (CWE-79) - CVE-2023-3332

OS command injection (CWE-78) - CVE-2023-3333

Impact

• An authenticated attacker may obtain specific files in the product - CVE-2023-3330
• An authenticated attacker may delete specific files in the product - CVE-2023-3331
• After obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities, the attacker may execute an arbitrary script - CVE-2023-3332
• After obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities, the attacker may execute an arbitrary OS command with the root privilege - CVE-2023-3333

Solution

Stop using the products
The affected products are no longer supported. Stop using the vulnerable products and consider switching to alternatives.

Apply a workaround
The developer states there is no plan to provide firmware updates for the affected products, therefore recommends users to apply workarounds to mitigate the impacts of the vulnerabilities before switching to alternatives.

For details, refer to the information provided by the developer.

Products Affected

All versions of following Aterm series are affected by the vulnerabilities.

• WG2600HP2
• WG2600HP
• WG2200HP
• WG1800HP2
• WG1800HP
• WG1400HP
• WG600HP
• WG300HP
• WF300HP
• WR9500N
• WR9300N
• WR8750N
• WR8700N
• WR8600N
• WR8370N
• WR8175N
• WR8170N