Authentication flaw

An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmwar...

CVE-2017-12575

An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmwar...

CVE-2017-12575

An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmwar...

CVE-2017-12575

CVE-2017-12575 affects NEC Aterm WG2600HP2 (and related WG2600HP variants). Connected sources describe an improper access control issue where web service APIs for the device configuration do not require authentication, allowing an attacker to retrieve sensitive data (e.g., DHCP clients, firmware ...

NEC Aterm WG2600HP2 Information Disclosure Vulnerability

The WG2600HP2 is a router product from NEC. The NEC Aterm WG2600HP2 has an information disclosure vulnerability that could allow an attacker to retrieve the DHCP client by sending a crafted HTTP request...

Multiple vulnerabilities in Aterm HC100RC

Overview Aterm HC100RC provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0634, CVE-2018-0635, CVE-2018-0636, CVE-2018-0637, CVE-2018-0638, CVE-2018-0639 Buffer Overflow CWE-119 - CVE-2018-0640, CVE-2018-0641 Taizoh Tsukamoto of Mits...

Multiple vulnerabilities in Aterm W300P

Overview Aterm W300P provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0629, CVE-2018-0630, CVE-2018-0631 Buffer Overflow CWE-119 - CVE-2018-0632, CVE-2018-0633 Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this...

Multiple OS command injection vulnerabilities in Aterm WG1200HP

Overview Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities CWE-78. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

JVN#26629618: Multiple vulnerabilities in Aterm W300P

Aterm W300P provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0629, CVE-2018-0630, CVE-2018-0631 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H| Base Score: 6.8 CVSS v2|...

JVN#84825660: Multiple vulnerabilities in Aterm HC100RC

Aterm HC100RC provided by NEC Corporation contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2018-0634, CVE-2018-0635, CVE-2018-0636, CVE-2018-0637, CVE-2018-0638, CVE-2018-0639 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H...

JVN#00401783: Multiple OS command injection vulnerabilities in Aterm WG1200HP

Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities CWE-78. Impact A user who can access the product with administrative privileges may execute an arbitrary OS command. Solution Update the Firmware Apply the latest firmware update according to the...

CVE-2016-1168

Cross-site request forgery CSRF vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users...

CVE-2016-1167

Cross-site request forgery CSRF vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users...

CVE-2016-1167

Cross-site request forgery CSRF vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users...

CVE-2016-1167

The CVE-2016-1167 issue affects the NEC Aterm WG300HP wireless router. A cross-site request forgery (CSRF) vulnerability could allow an attacker to hijack the authentication of an authenticated user. Affected component: the device’s management interface (web UI); root cause is CSRF (CWE-352) enab...

CVE-2016-1167

Cross-site request forgery CSRF vulnerability on NEC Aterm WG300HP devices allows remote attackers to hijack the authentication of arbitrary users...

CVE-2016-1168

CVE-2016-1168 affects NEC Aterm WF800HP devices with firmware version 1.0.17 and earlier. The vulnerability is a Cross-site Request Forgery (CSRF) that can allow a logged-in user to be coerced into performing unintended actions when visiting a malicious page, potentially hijacking the user’s auth...

CVE-2016-1168

Cross-site request forgery CSRF vulnerability on NEC Aterm WF800HP devices with firmware 1.0.17 and earlier allows remote attackers to hijack the authentication of arbitrary users...