CVE-2024-28007CWE-287

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

🚨 An improper authentication flaw in a whopping 50 models of NEC routers allows attackers to execute arbitrary commands with root privileges from anywhere on the internet! 🔥 Think of this like a hotel without proper guest checks — anyone could waltz in and head straight to the penthouse suite, no questions asked! This vulnerability could lead to an attacker gaining total control of the router, which means they could easily intercept traffic, modify configurations, or even launch attacks on other devices in the network. It’s absolutely devastating for anyone relying on these routers for secure communication!

Put simply

Think of this like a hotel without proper guest checks — anyone could waltz in and head straight to the penthouse suite, no questions asked! The flaw arises from inadequate authentication checks, allowing unauthorized users to send commands directly to the device, effectively bypassing security measures. This means an attacker could leverage this vulnerability to execute commands with root privileges as if they were the legitimate administrator.

What to do

This vulnerability could lead to an attacker gaining total control of the router, which means they could easily intercept traffic, modify configurations, or even launch attacks on other devices in the network. It’s absolutely devastating for anyone relying on these routers for secure communication! Immediately update your NEC router firmware to the latest version and change any default or easily guessable passwords. Regularly audit and monitor your network for unauthorized access. Don’t wait — patching NOW could save you from a world of hurt! You've got this! Secure your network, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-03-28T00:52Z
EPSS history
Timeline
  • 28 MAR 00:52Z
    Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…
    cvelistv5