Main Vulnerability Database Vulnerabilities #VU25452

OS Command Injection in NEC Corporation products - CVE-2020-5525

Published: February 19, 2020

Vulnerability identifier: #VU25452

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-5525

CWE-ID: CWE-78

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A remote user on the local network who can access the management screen of the device may execute an arbitrary OS command with root privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Aterm WF1200CR
Aterm WG1200CR
Aterm WG2600HS

How to mitigate CVE-2020-5525

Install updates from vendor's website.

Aterm WF1200CR - update to 1.3.2
Aterm WG1200CR - update to 1.3.3
Aterm WG2600HS - update to 1.5.1

External References

Related Security Bulletins