Cross site scripting

Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5525

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

CVE-2020-5534

Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors...

CVE-2020-5534

CVE-2020-5534 affects NEC Aterm WG2600HS firmware versions 1.3.2 and earlier. Connected documents confirm an OS command injection vulnerability where an authenticated attacker on the same network segment can execute arbitrary OS commands with root privileges. Root cause is unfiltered external inp...

CVE-2020-5533

Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5533

CVE-2020-5533 affects NEC Aterm WG2600HS firmware 1.3.2 and earlier. The issue is a cross-site scripting vulnerability in the device web interface caused by insufficient input validation in the web application, allowing an arbitrary script to run in the logged-in user’s browser. Affected componen...

CVE-2020-5524

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function...

CVE-2020-5525

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

CVE-2020-5525

CVE-2020-5525 affects NEC Aterm WF1200C (firmware v1.2.1 and earlier), Aterm WG1200CR (v1.2.1 and earlier), and Aterm WG2600HS (v1.3.2 and earlier). The vulnerability is an OS command injection via the device management screen, exploitable by an authenticated attacker on the same network segment ...

CVE-2020-5524

CVE-2020-5524 affects NEC Aterm devices (WF1200C v1.2.1 and earlier; WG1200CR v1.2.1 and earlier; WG2600HS v1.3.2 and earlier). The flaw allows an attacker on the same network segment to run arbitrary OS commands with root privileges via the UPnP interface. Public sources in the connected documen...

NEC Aterm WG2600HS Cross-Site Scripting Vulnerability

The NEC Aterm WG2600HS is a wireless router from Nippon Electric NEC. A cross-site scripting vulnerability exists in the NEC Aterm WG2600HS version 1.3.2, which originates from a WEB application that lacks proper validation of client data. An attacker can exploit the vulnerability to execute...

NEC Aterm WF1200C, Aterm WG1200CR and Aterm WG2600HS Operating System Command Injection Vulnerability

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WF1200C 1.2.1 and earlier, Aterm WG1200CR 1.2.1 and earlier, and Aterm WG2600HS 1.3.2 and earlier, where the vulnerability arises from a...

Multiple OS command injection vulnerabilities in Aterm WF1200C, Aterm WG1200CR, and Aterm WG2600HS

Overview Aterm WF1200C, Aterm WG1200CR, and Aterm WG2600HS provided by NEC Corporation contain multiple OS command injection vulnerabilities listed below. OS command injection vulnerability in UPnP function CWE-78 - CVE-2020-5524 OS command injection vulnerability in management screen CWE-78 -...

Multiple vulnerabilities in Aterm WG2600HS

Overview Aterm WG2600HS provided by NEC Corporation contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2020-5533 OS command injection CWE-78 - CVE-2020-5534 Satoru Nagaoka of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wit...

JVN#25766797: Multiple OS command injection vulnerabilities in Aterm WF1200C, Aterm WG1200CR, and Aterm WG2600HS

Aterm WF1200C, Aterm WG1200CR, and Aterm WG2600HS provided by NEC Corporation contain multiple OS command injection vulnerabilities listed below. OS command injection vulnerability in UPnP function CWE-78 - CVE-2020-5524 Version| Vector| Score ---|---|--- CVSS v3|...

JVN#49410695: Multiple vulnerabilities in Aterm WG2600HS

Aterm WG2600HS provided by NEC Corporation contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2020-5533 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N| Base Score: 2.6 OS...

NEC Aterm WF1200C, Aterm WG1200CR and Aterm WG2600HS Operating System Command Injection Vulnerability

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WF1200C 1.2.1 and earlier, Aterm WG1200CR 1.2.1 and earlier, and Aterm WG2600HS 1.3.2 and earlier, where the vulnerability arises from a...

NEC Aterm HC100RC OS Command Injection Vulnerability (CNVD-2019-01108)

The NEC Aterm HC100RC is a network camera from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm HC100RC using firmware version 1.0.1 and earlier. The vulnerability can be exploited to execute arbitrary operating system commands with the...

NEC Aterm HC100RC Buffer Overflow Vulnerability (CNVD-2019-01316)

The NEC Aterm HC100RC is a network camera from Nippon Electric NEC. A buffer overflow vulnerability exists in the NEC Aterm HC100RC using firmware version 1.0.1 and earlier, which can be exploited by an attacker to execute arbitrary code with the help of the 'date', 'time' and 'offset ' parameter...

NEC Aterm W300P OS Command Injection Vulnerability (CNVD-2019-01102)

The NEC Aterm W300P is a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm W300P using firmware version 1.0.13 and earlier. An attacker can exploit this vulnerability to execute arbitrary operating system commands via HTTP reques...