CVE-2024-28011CWE-912

Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

🚨 A hidden functionality bug in NEC's routers could let attackers execute OS commands with root privileges from the internet — and they don't even need to break a sweat! 🔥 Think of it like a restaurant where the waiter mistakenly reveals the chef's secret door to the kitchen; any patron could stroll in, cook their own meal, or even alter recipes without anyone being the wiser! This vulnerability is absolutely devastating. An attacker could take complete control of affected router models, potentially intercepting network traffic, modifying configurations, or even launching further attacks on connected devices. The ramifications could extend far beyond just one network, putting tons of users at risk!

Put simply

Think of it like a restaurant where the waiter mistakenly reveals the chef's secret door to the kitchen; any patron could stroll in, cook their own meal, or even alter recipes without anyone being the wiser! The hidden functionality flaw allows unauthorized OS command execution with root privileges on a range of NEC routers, exposing them to remote exploitation via the internet.

What to do

This vulnerability is absolutely devastating. An attacker could take complete control of affected router models, potentially intercepting network traffic, modifying configurations, or even launching further attacks on connected devices. The ramifications could extend far beyond just one network, putting tons of users at risk! Patch affected devices immediately and upgrade to the latest firmware provided by NEC. Ensure that any unused features are disabled to minimize the attack surface, and consider implementing network segmentation to enhance security. 🛡️ You've got this! Follow these steps, and you'll lock down your network in no time! 🔒

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.3th percentile
Weakness
CWE-912 · Hidden Functionality
Published
2024-03-28T00:54Z
EPSS history
Timeline
  • 28 MAR 00:54Z
    Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…
    cvelistv5