CVE-2020-5524 — OS Command Injection in Aterm Wf1200c Firmware

CWE-78 — OS Command Injection3 documents3 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 54.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
NEC Aterm Wf1200c FirmwareNEC Aterm Wg1200cr FirmwareNEC Aterm Wg2600hs Firmware+1 more
Timeline
PublishedFeb 21
Latest updateMay 24

Description

Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5nec_corporation/aterm_seriesAterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier

🔴Vulnerability Details

2
GHSA
GHSA-48x3-vgp6-cxw2: Aterm series (Aterm WF1200C firmware Ver1↗2022-05-24
▶
CVEList
CVE-2020-5524: Aterm series (Aterm WF1200C firmware Ver1↗2020-02-21
▶
CVE-2020-5524 — OS Command Injection | cvebase