Vulnerability Details : CVE-2023-3331
Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to delete
specific files in the product.
Vulnerability category: Directory traversal
Products affected by CVE-2023-3331
- cpe:2.3:o:nec:aterm_wf300hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg1400hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg1800hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg1800hp2_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg2200hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg2600hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg2600hp2_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg300hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wg600hp_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8600n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8700n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8750n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr9300n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr9500n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8170n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8175n_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:nec:aterm_wr8370n_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-3331
0.11%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 31 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-3331
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.4
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
2.8
|
2.5
|
NIST |
CWE ids for CVE-2023-3331
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by:
- nvd@nist.gov (Primary)
- psirt-info@cyber.jp.nec.com (Secondary)
References for CVE-2023-3331
Jump to