Medium severity · published Jun 28, 2023
CVE-2023-3330
Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP,…
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to obtain specific files in the product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Aterm WF300HP · NEC Corporation
all versions · source: vendor
AW
Aterm WG1400HP · NEC Corporation
all versions · source: vendor
AW
Aterm WG1800HP · NEC Corporation
all versions · source: vendor
AW
Aterm WG1800HP2 · NEC Corporation
all versions · source: vendor
AW
Aterm WG2200HP · NEC Corporation
all versions; all versions · source: vendor
AW
Aterm WG2600HP · NEC Corporation
all versions · source: vendor
AW
Aterm WG2600HP2 · NEC Corporation
all versions · source: vendor
AW
Aterm WG300HP · NEC Corporation
all versions · source: vendor
AW
Aterm WG600HP · NEC Corporation
all versions · source: vendor
AW
Aterm WR8170N · NEC Corporation
all versions · source: vendor
AW
Aterm WR8175N · NEC Corporation
all versions · source: vendor
AW
Aterm WR8370N · NEC Corporation
all versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3330
jpn.nec.com
https://jpn.nec.com/security-info/secinfo/nv23-007_en.html
More from Aterm WF300HP
7.2
CVE-2023-3333
Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP,…
5.4
CVE-2023-3331
Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP,…
4.8
CVE-2023-3332
Improper Neutralization of Input During Web Page Generation vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP,…