What is the CVSS score of CVE-2024-28015?

CVE-2024-28015 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Aterm Wg1800Hp4 Firmware CVE-2024-28015

CRITICAL

OS Command Injection (CWE-78)

2024-03-28 psirt-info@cyber.jp.nec.com

Command Injection Aterm Wg1800Hp4 Firmware Aterm Wg1200Hs3 Firmware Aterm Wg1900Hp2 Firmware Aterm Wg1200Hp3 Firmware Aterm Wg1800Hp3 Firmware Aterm Wr7850S Firmware Aterm Wr6650S Firmware Aterm Wr6600H Firmware Aterm Wr7800H Firmware Aterm Wm3400Rn Firmware Aterm Wm3450Rn Firmware Aterm Wm3500R Firmware Aterm Wm3600R Firmware Aterm Wm3800R Firmware Aterm Wr8166N Firmware Aterm Mr01Ln Firmware Aterm Mr02Ln Firmware Aterm Wg1810Hp Je Firmware Aterm Wg1810Hp Mf Firmware Aterm Wg1200Hs2 Firmware Aterm Wg1900Hp Firmware Aterm Wg1200Hp2 Firmware Aterm W1200Ex Ms Firmware Aterm Wg1200Hs Firmware Aterm Wg1200Hp Firmware Aterm Wf300Hp2 Firmware Aterm W300P Firmware Aterm Wf800Hp Firmware Aterm Wr8165N Firmware Aterm Wg2200Hp Firmware Aterm Wf1200Hp2 Firmware Aterm Wg1800Hp2 Firmware Aterm Wf1200Hp Firmware Aterm Wg600Hp Firmware Aterm Wg300Hp Firmware Aterm Wf300Hp Firmware Aterm Wg1800Hp Firmware Aterm Wg1400Hp Firmware Aterm Wr8175N Firmware Aterm Wr9300N Firmware Aterm Wr8750N Firmware Aterm Wr8160N Firmware Aterm Wr9500N Firmware Aterm Wr8600N Firmware Aterm Wr8370N Firmware Aterm Wr8170N Firmware Aterm Wr8700N Firmware Aterm Wr8300N Firmware Aterm Wr8150N Firmware Aterm Wr4100N Firmware Aterm Wr4500N Firmware Aterm Wr8100N Firmware Aterm Wr8500N Firmware Aterm Cr2500P Firmware Aterm Wr8400N Firmware Aterm Wr8200N Firmware Aterm Wr1200H Firmware Aterm Wr7870S Firmware Aterm Wr6670S Firmware

9.8

CVSS 3.1 · Vendor: cyber

Severity by source

Vendor (cyber) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (cyber) · only source for this CVE.

CVSS VectorVendor: cyber

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 28, 2024 - 01:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary OS command with the root privilege via the internet.

AnalysisAI

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as OS Command Injection (CWE-78), which allows attackers to execute arbitrary operating system commands on the host. Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary OS command with the root privilege via the internet. Affected products include: Nec Aterm Wg1800Hp4 Firmware, Nec Aterm Wg1200Hs3 Firmware, Nec Aterm Wg1900Hp2 Firmware, Nec Aterm Wg1200Hp3 Firmware, Nec Aterm Wg1800Hp3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid passing user input to shell commands. Use language-specific APIs instead of shell execution. Apply strict input validation with allowlists.