Log in Start free

Vulnerability · Published Jun 28, 2023 · Assigned by NEC

CVE-2023-3333

High 7.2

In plain English

A high-severity OS command injection in Aterm WF300HP from NEC Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS NVD)7.2High
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

Affected products (as reported)

VendorProductVersions
NEC Corporation Aterm WG2600HP2 all versions
NEC Corporation Aterm WG2600HP all versions
NEC Corporation Aterm WG2200HP all versions
NEC Corporation Aterm WG2200HP all versions
NEC Corporation Aterm WG1800HP2 all versions
NEC Corporation Aterm WG1800HP all versions
NEC Corporation Aterm WG1400HP all versions
NEC Corporation Aterm WG600HP all versions
NEC Corporation Aterm WG300HP all versions
NEC Corporation Aterm WF300HP all versions
NEC Corporation Aterm WR9500N all versions
NEC Corporation Aterm WR9300N all versions
NEC Corporation Aterm WR8750N all versions
NEC Corporation Aterm WR8700N all versions
NEC Corporation Aterm WR8600N all versions
NEC Corporation Aterm WR8370N all versions
NEC Corporation Aterm WR8175N all versions
NEC Corporation Aterm WR8170N all versions

Weakness: CWE-78

References