Read the docs
TI-2021-04062 Aliases CVE-2021-20847GHSA-5f3c-9rrr-9rp4

Cross-site scripting in NTT DOCOMO, INC. Wi-Fi STATION SH-52A

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C) allows a remote unauthenticated attacker to inject an arbitrary script via WebUI of the device.

Why it matters now

EPSS 0.00842 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
NTT DOCOMO, INC.Wi-Fi STATION SH-52A38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C—No fix listedCNA
  • Wi-Fi STATION SH-52A VendorNTT DOCOMO, INC. Affected 38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_26J, 38JP_2_03B, and 38JP_2_03C Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11g:*:*:*:*:*:*:*38jp_1_11gVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11j:*:*:*:*:*:*:*38jp_1_11jVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11k:*:*:*:*:*:*:*38jp_1_11kVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11l:*:*:*:*:*:*:*38jp_1_11lVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26f:*:*:*:*:*:*:*38jp_1_26fVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26g:*:*:*:*:*:*:*38jp_1_26gVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26j:*:*:*:*:*:*:*38jp_1_26jVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_2_03b:*:*:*:*:*:*:*38jp_2_03bVulnerableNTT DOCOMO, INC.
cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_2_03c:*:*:*:*:*:*:*38jp_2_03cVulnerableNTT DOCOMO, INC.
cpe:2.3:h:nttdocomo:wi-fi_station_sh-52a:-:*:*:*:*:*:*:*not specified by NVDRunning onNTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11g:*:*:*:*:*:*:* Versions 38jp_1_11g Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11j:*:*:*:*:*:*:* Versions 38jp_1_11j Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11k:*:*:*:*:*:*:* Versions 38jp_1_11k Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_11l:*:*:*:*:*:*:* Versions 38jp_1_11l Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26f:*:*:*:*:*:*:* Versions 38jp_1_26f Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26g:*:*:*:*:*:*:* Versions 38jp_1_26g Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_1_26j:*:*:*:*:*:*:* Versions 38jp_1_26j Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_2_03b:*:*:*:*:*:*:* Versions 38jp_2_03b Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:o:nttdocomo:wi-fi_station_sh-52a_firmware:38jp_2_03c:*:*:*:*:*:*:* Versions 38jp_2_03c Vulnerable ·NTT DOCOMO, INC.
  • cpe:2.3:h:nttdocomo:wi-fi_station_sh-52a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NTT DOCOMO, INC.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20847
  2. 2026-10-03 Alias added: GHSA-5f3c-9rrr-9rp4

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences