Medium severity · published Jan 15, 2025
CVE-2025-0354
Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2…
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
WG2600HM4 · NEC Corporation
Ver.1.4.2 and earlier · source: vendor
WG
WG2600HP4 · NEC Corporation
Ver.1.4.2 and earlier · source: vendor
WG
WG2600HS · NEC Corporation
Ver.1.7.2 and earlier · source: vendor
WG
WG2600HS2 · NEC Corporation
Ver.1.3.2 and earlier · source: vendor
WX
WX3000HP · NEC Corporation
Ver.2.4.2 and earlier · source: vendor
WX
WX4200D5 · NEC Corporation
Ver.1.2.4 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0354
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0354
jpn.nec.com
https://jpn.nec.com/security-info/secinfo/nv25-003_en.html
More from WG2600HM4
7.5
CVE-2025-0355
Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and…