CVE-2023-3333
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
CVE-2023-3333 describes an improper neutralization of special elements used in OS commands vulnerability in NEC Corporation Aterm devices, allowing an attacker to execute arbitrary OS commands with root privileges after obtaining high privileges by exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.
Risk Assessment
The organization is at risk of unauthorized access to the system and potential data loss or loss of control over network devices.
Recommendation
It is recommended to update the devices to the latest software version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N, WR8170N
See all- CVE-2023-3331Medium
The CVE-2023-3331 vulnerability in NEC Corporation Aterm products has an improper limitation of a pathname to a restricted directory, allowing an attacker to delete specific files in the product.
- CVE-2023-3330Medium
CVE-2023-3330 describes an improper limitation of a pathname to a restricted directory vulnerability in NEC Corporation products, allowing an attacker to access specific files on the device.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.