CVE-2024-28009CWE-287

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

🚨 An improperly authenticated router can turn your home network into an attacker's playground! 🔥 Think of this vulnerability like a front door that can be opened with any key — one little oversight in ensuring only the right keys get in could let anyone walk right into your home network. It’s like leaving your Wi-Fi unlocked for all your neighbors to use, and worse, to control! With this vulnerability, an attacker could execute arbitrary commands with root privileges via the internet. This means they could not only snoop on your network traffic but also potentially take full control of your devices, disrupt your internet, or exfiltrate sensitive data. Yikes!

Put simply

Think of this vulnerability like a front door that can be opened with any key — one little oversight in ensuring only the right keys get in could let anyone walk right into your home network. It’s like leaving your Wi-Fi unlocked for all your neighbors to use, and worse, to control! This improper authentication vulnerability affects NEC Corporation routers, allowing attackers to gain root access without proper credentials, essentially bypassing expected security measures. This is especially concerning since the devices are widely deployed in home networks.

What to do

With this vulnerability, an attacker could execute arbitrary commands with root privileges via the internet. This means they could not only snoop on your network traffic but also potentially take full control of your devices, disrupt your internet, or exfiltrate sensitive data. Yikes! Immediate action is crucial! Update your device firmware to the latest version released by NEC to patch this vulnerability. Additionally, consider changing default credentials and enabling any extra security features available on your router. Don’t wait! You've got this! Follow these steps to secure your devices and keep your network safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-03-28T00:53Z
EPSS history
Timeline
  • 28 MAR 00:53Z
    Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…
    cvelistv5