Cross-site request forgery in NEC Corporation Aterm WG2600HP and Aterm WG2600HP2
Priority LOW 39CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Why it matters now
EPSS 0.00653 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NEC Corporation | Aterm WG2600HP and Aterm WG2600HP2 | Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier | — | No fix listed | CNA |
- Aterm WG2600HP and Aterm WG2600HP2 VendorNEC Corporation Affected Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:aterm:wg2600hp_firmware:*:*:*:*:*:*:*:* | up to 1.0.2 | Vulnerable | Aterm |
| cpe:2.3:h:aterm:wg2600hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Aterm |
| cpe:2.3:o:aterm:wg2600hp2_firmware:*:*:*:*:*:*:*:* | up to 1.0.2 | Vulnerable | Aterm |
| cpe:2.3:h:aterm:wg2600hp2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Aterm |
- cpe:2.3:o:aterm:wg2600hp_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.2 Vulnerable ·Aterm
- cpe:2.3:h:aterm:wg2600hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Aterm
- cpe:2.3:o:aterm:wg2600hp2_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.2 Vulnerable ·Aterm
- cpe:2.3:h:aterm:wg2600hp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Aterm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20621
- 2026-10-03 Alias added: GHSA-6r2v-76j8-x9vv
- 2026-10-20 EPSS moved to the 50th–90th percentile
References
More NEC Corporation vulnerabilities
- TI-1999-00042 Command execution via shell metachars in INN daemon (innd) 1.5 using "newgroup" and… CVSS 3.1CRITICAL 9.8
- TI-2020-13174 XML external entity injection in NEC Corporation ExpressCluster CVSS 3.1HIGH 7.5
- TI-1999-00009 Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. CVSS 2.0HIGH 10.0
- TI-2018-08402 NEC Univerge Sv9100 WebPro 6.00.00 devices have Predictable Session IDs that result in… CVSS 3.1CRITICAL 9.8
- TI-2018-08403 NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. CVSS 3.1CRITICAL 9.8
- TI-1999-00205 rpc.ypupdated (NIS) allows remote users to execute arbitrary commands. CVSS 2.0HIGH 10.0
Sources
- CVE-2021-20621 · CVE Program
- CVE-2021-20621 · NVD
- FIRST EPSS
- GHSA-6r2v-76j8-x9vv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences