Published:2018/07/12  Last Updated:2018/07/12

JVN#00401783
Multiple OS command injection vulnerabilities in Aterm WG1200HP

Overview

Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities.

Products Affected

  • WG1200HP firmware Ver1.0.31 and earlier

Description

Aterm WG1200HP provided by NEC Corporation contains multiple OS command injection vulnerabilities (CWE-78).

Impact

A user who can access the product with administrative privileges may execute an arbitrary OS command.

Solution

Update the Firmware
Apply the latest firmware update according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
NEC Corporation Vulnerable 2018/07/12

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score: 6.8
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)
CVSS v2 AV:A/AC:L/Au:S/C:P/I:P/A:P
Base Score: 5.2
Access Vector(AV) Local (L) Adjacent Network (A) Network (N)
Access Complexity(AC) High (H) Medium (M) Low (L)
Authentication(Au) Multiple (M) Single (S) None (N)
Confidentiality Impact(C) None (N) Partial (P) Complete (C)
Integrity Impact(I) None (N) Partial (P) Complete (C)
Availability Impact(A) None (N) Partial (P) Complete (C)

Credit

Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2018-0625
CVE-2018-0626
CVE-2018-0627
CVE-2018-0628
JVN iPedia JVNDB-2018-000075