Skip to content
Fencer Vulns
high 7.2

CVE-2023-3333 json

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1…

published 2023-06-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44001

cvss
7.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 mo ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • NEC Corporation Aterm WG2600HP2
  • NEC Corporation Aterm WG2600HP
  • NEC Corporation Aterm WG2200HP
  • NEC Corporation Aterm WG1800HP2
  • NEC Corporation Aterm WG1800HP
  • NEC Corporation Aterm WG1400HP
  • NEC Corporation Aterm WG600HP
  • NEC Corporation Aterm WG300HP
  • NEC Corporation Aterm WF300HP
  • NEC Corporation Aterm WR9500N
  • NEC Corporation Aterm WR9300N
  • NEC Corporation Aterm WR8750N
  • NEC Corporation Aterm WR8700N
  • NEC Corporation Aterm WR8600N
  • NEC Corporation Aterm WR8370N
  • NEC Corporation Aterm WR8175N
  • NEC Corporation Aterm WR8170N

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.