CVE-2023-3333 : Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG26

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

Published 2023-06-28 02:15:50

Updated 2023-07-05 19:19:53

Source NEC Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-3333

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3333

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-3333

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by:

nvd@nist.gov (Primary)
psirt-info@cyber.jp.nec.com (Secondary)

Products affected by CVE-2023-3333

NEC » Aterm Wf300hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wf300hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wf300hp » Version: N/A
NEC » Aterm Wg1400hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg1400hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg1400hp » Version: N/A
NEC » Aterm Wg1800hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg1800hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg1800hp » Version: N/A
NEC » Aterm Wg1800hp2 Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg1800hp2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg1800hp2 » Version: N/A
NEC » Aterm Wg2200hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg2200hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg2200hp » Version: N/A
NEC » Aterm Wg2600hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg2600hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg2600hp » Version: N/A
NEC » Aterm Wg2600hp2 Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg2600hp2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg2600hp2 » Version: N/A
NEC » Aterm Wg300hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg300hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg300hp » Version: N/A
NEC » Aterm Wg600hp Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wg600hp_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wg600hp » Version: N/A
NEC » Aterm Wr8600n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8600n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8600n » Version: N/A
NEC » Aterm Wr8700n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8700n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8700n » Version: N/A
NEC » Aterm Wr8750n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8750n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8750n » Version: N/A
NEC » Aterm Wr9300n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr9300n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr9300n » Version: N/A
NEC » Aterm Wr9500n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr9500n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr9500n » Version: N/A
NEC » Aterm Wr8170n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8170n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8170n » Version: N/A
NEC » Aterm Wr8175n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8175n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8175n » Version: N/A
NEC » Aterm Wr8370n Firmware » Version: N/A
cpe:2.3:o:nec:aterm_wr8370n_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: NEC » Aterm Wr8370n » Version: N/A

Vulnerability Details : CVE-2023-3333

Exploit prediction scoring system (EPSS) score for CVE-2023-3333

CVSS scores for CVE-2023-3333

CWE ids for CVE-2023-3333

References for CVE-2023-3333

Products affected by CVE-2023-3333