CVE-2018-0636: Improper Neutralization of Special Elements used in an OS Command

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634...

PT-2019-8676

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware versions 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. Recommendations For Aterm WG1200HP firmware versions 1.0.31...

PT-2019-9260

Name of the Vulnerable Software and Affected Versions Aterm WF1200CR versions 1.1.1 and earlier Aterm WG1200CR versions 1.0.1 and earlier Description The issue allows authenticated attackers to execute arbitrary OS commands. Recommendations For Aterm WF1200CR versions 1.1.1 and earlier, update to...

PT-2019-9261

Name of the Vulnerable Software and Affected Versions Aterm WF1200CR versions 1.1.1 and earlier Aterm WG1200CR versions 1.0.1 and earlier Description The issue allows an attacker on the same network segment to execute arbitrary OS commands via the SOAP interface of UPnP. Recommendations For Aterm...

CVE-2018-16194: Improper Neutralization of Special Elements used in an OS Command

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors...

PT-2019-8680

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary code via HTTP request and response due to a buffer overflow. Recommendations For versions 1.0.13 and earlier, updat...

PT-2019-8674

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware version 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This can be achieved via the sysCmd in the formWsc parameter. Recommendations For Aterm...

PT-2019-8679

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This can be achieved via the targetAPSsid parameter. Recommendations For Aterm W300P versions 1.0.13 a...

PT-2019-8673

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware version 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This is achieved via the formSysCmd parameter. Recommendations For Aterm WG1200HP firmware...

PT-2019-9258

Name of the Vulnerable Software and Affected Versions Aterm WF1200CR versions 1.1.1 and earlier Aterm WG1200CR versions 1.0.1 and earlier Description The issue allows an attacker on the same network segment to obtain information registered on the device via unspecified vectors. Recommendations Fo...

CVE-2018-16192: Exposure of Sensitive Information to an Unauthorized Actor

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allow an attacker on the same network segment to obtain information registered on the device via unspecified vectors...

CVE-2018-0640: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter...

CVE-2018-0625: Improper Neutralization of Special Elements used in an OS Command

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter...

PT-2019-8677

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. Recommendations For Aterm W300P versions 1.0.13 and earlier, at the...

PT-2019-8685

Name of the Vulnerable Software and Affected Versions Aterm HC100RC version 1.0.1 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This is achieved via the export.cgi encKey parameter. Recommendations For Aterm HC100RC version 1.0.1...

CVE-2018-0638: Improper Neutralization of Special Elements used in an OS Command

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter...

PT-2019-8681

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description A buffer overflow issue allows an attacker with administrator rights to execute arbitrary code via the submit-url parameter. Recommendations For Aterm W300P versions 1.0.13 and earlier, updat...

NEC Aterm WF1200CR and Aterm WG1200CR Operating System Command Injection Vulnerability (CNVD-2018-25741)

The NEC Aterm WF1200CR and Aterm WG1200CR are both router products from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WF1200CR with firmware version 1.1.1 and earlier and the Aterm WG1200CR with firmware version 1.0.1 and earlier, which can be...

NEC Aterm WF1200CR and Aterm WG1200CR Information Disclosure Vulnerability

The NEC Aterm WF1200CR and Aterm WG1200CR are both router products from Nippon Electric NEC. An information disclosure vulnerability exists in the NEC Aterm WF1200CR with firmware version 1.1.1 and earlier and the Aterm WG1200CR with firmware version 1.0.1 and earlier, which can be exploited by a...

Multiple vulnerabilities in Aterm WF1200CR and Aterm WG1200CR

Overview Aterm WF1200CR and Aterm WG1200CR provided by NEC Corporation contain multiple vulnerabilities listed below. Information disclosure CWE-200 - CVE-2018-16192 Stored cross-site scripting CWE-79 - CVE-2018-16193 OS command injection CWE-78 - CVE-2018-16194 OS command injection in SOAP...