CVE-2024-28008CWE-489

Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS…

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

🚨 An active debug code lets attackers run arbitrary OS commands on various NEC routers—like giving a stranger the keys to your network! 🔥 Think of it as leaving your front door wide open and handing out invitations to anyone who walks by. An attacker can just stroll right in and control your devices without breaking a sweat. This vulnerability poses an absolutely devastating risk; an attacker could execute any command on your router, potentially hijacking your entire network. They could steal sensitive data, manipulate network settings, or even launch attacks on other systems—talk about a nightmare scenario!

Put simply

Think of it as leaving your front door wide open and handing out invitations to anyone who walks by. An attacker can just stroll right in and control your devices without breaking a sweat. The flaw exists in multiple NEC router models, allowing attackers to execute arbitrary OS commands through the debug interface that is inadvertently exposed to the internet. This means anyone with knowledge of the exploit can take complete control over the affected devices.

What to do

This vulnerability poses an absolutely devastating risk; an attacker could execute any command on your router, potentially hijacking your entire network. They could steal sensitive data, manipulate network settings, or even launch attacks on other systems—talk about a nightmare scenario! Patch your devices immediately to the latest firmware version to close this debug interface. Check the manufacturer's site for updated releases and consider disabling remote access as a precautionary measure. Don't forget to monitor network logs for any suspicious activity during this time! You’ve got this! Follow these steps, and you’ll keep your network secure in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.2th percentile
Weakness
CWE-489 · Active Debug Code
Published
2024-03-28T00:52Z
EPSS history
Timeline
  • 28 MAR 00:52Z
    Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS…
    cvelistv5