Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP,…

published 2024-03-28 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-25181

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary command with the root privilege via the internet.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-04-02)

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

NEC Corporation WG1800HP4
NEC Corporation WG1200HS3
NEC Corporation WG1900HP2
NEC Corporation WG1200HP3
NEC Corporation WG1800HP3
NEC Corporation WG1200HS2
NEC Corporation WG1900HP
NEC Corporation WG1200HP2
NEC Corporation W1200EX(-MS)
NEC Corporation WG1200HS
NEC Corporation WG1200HP
NEC Corporation WF300HP2
NEC Corporation W300P
NEC Corporation WF800HP
NEC Corporation WR8165N
NEC Corporation WG2200HP
NEC Corporation WF1200HP2
NEC Corporation WG1800HP2
NEC Corporation WF1200HP
NEC Corporation WG600HP
NEC Corporation WG300HP
NEC Corporation WF300HP
NEC Corporation WG1800HP
NEC Corporation WG1400HP
NEC Corporation WR8175N
NEC Corporation WR9300N
NEC Corporation WR8750N
NEC Corporation WR8160N
NEC Corporation WR9500N
NEC Corporation WR8600N
NEC Corporation WR8370N
NEC Corporation WR8170N
NEC Corporation WR8700N
NEC Corporation WR8300N
NEC Corporation WR8150N
NEC Corporation WR4100N
NEC Corporation WR4500N
NEC Corporation WR8100N
NEC Corporation WR8500N
NEC Corporation CR2500P
NEC Corporation WR8400N
NEC Corporation WR8200N
NEC Corporation WR1200H
NEC Corporation WR7870S
NEC Corporation WR6670S
NEC Corporation WR7850S
NEC Corporation WR6650S
NEC Corporation WR6600H
NEC Corporation WR7800H
NEC Corporation WM3400RN

Classification

Weakness

CWE-287 Improper Authentication

References

jpn.nec.com /security-info/secinfo/nv24-001_en.html
vendor-advisory
https //jpn.nec.com/security-info/secinfo/nv24-001_en.html
broken-link

Sources

CVE List CVE-2024-28007
NVD CVE-2024-28007

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary