CVE-2024-28012CWE-287

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…

Critical · published March 28, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
54.2
In the wild
Unconfirmed
What it is

🚨 An improperly authenticated router could allow attackers to execute arbitrary commands with root privileges, all thanks to a vulnerability lurking in NEC Corporation devices! 🔥 Think of it like a hotel with no front desk to check who’s entering. Anyone can just walk right in, and once they’re inside, they can decide to change the locks or take over entirely! This could be absolutely devastating! An attacker could gain total control over the router, possibly intercepting network traffic, altering configurations, or even launching attacks on other connected devices. Your entire home or office network could be at risk.

Put simply

Think of it like a hotel with no front desk to check who’s entering. Anyone can just walk right in, and once they’re inside, they can decide to change the locks or take over entirely! This vulnerability allows attackers to exploit improper authentication mechanisms in various NEC router models, enabling them to execute arbitrary commands with root privileges over the internet. The issue stems from the devices not adequately verifying user credentials before granting access.

What to do

This could be absolutely devastating! An attacker could gain total control over the router, possibly intercepting network traffic, altering configurations, or even launching attacks on other connected devices. Your entire home or office network could be at risk. Immediate action is crucial! Update all affected NEC router models to the latest firmware version to patch this vulnerability. Additionally, review and tighten security settings, and consider changing default passwords to something more secure. You’ve got this! With these steps, you can help protect your network and vanquish this vulnerability! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00743 · 54.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2024-03-28T00:55Z
EPSS history
Timeline
  • 28 MAR 00:55Z
    Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2…
    cvelistv5