OS command injection in NEC Platforms, Ltd. UNIVERGE DT
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE WA 2611-AP Ver8.2.11 and prior, UNIVERGE WA 2611E-AP Ver8.2.11 and prior, UNIVERGE WA WA2612-AP Ver8.2.11 and prior allows a remote attacker to execute arbitrary OS commands.
Why it matters now
EPSS 0.01442 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NEC Platforms, Ltd. | UNIVERGE DT | UNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE WA 2611-AP Ver8.2.11 and prior, UNIVERGE WA 2611E-AP Ver8.2.11 and prior, UNIVERGE WA WA2612-AP Ver8.2.11 and prior, | — | No fix listed | CNA |
- UNIVERGE DT VendorNEC Platforms, Ltd. Affected UNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE WA 2611-AP Ver8.2.11 and prior, UNIVERGE WA 2611E-AP Ver8.2.11 and prior, UNIVERGE WA WA2612-AP Ver8.2.11 and prior, Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:nec:univerge_wa1020_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa1020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa1510_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa1510:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa1511_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa1511:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa1512_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa1512:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa2020_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
- cpe:2.3:o:nec:univerge_wa1020_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa1510_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa1510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa1511_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa1511:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa1512_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa1512:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa2020_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:nec:univerge_wa2021_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2021:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa2610-ap_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2610-ap:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa2611-ap_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2611-ap:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa2611e-ap_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2611e-ap:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:univerge_wa2612-ap_firmware:*:*:*:*:*:*:*:* | up to 8.2.11 | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:univerge_wa2612-ap:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
- cpe:2.3:o:nec:univerge_wa2021_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2021:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa2610-ap_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2610-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa2611-ap_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2611-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa2611e-ap_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2611e-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:univerge_wa2612-ap_firmware:*:*:*:*:*:*:*:* Versions up to 8.2.11 Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:univerge_wa2612-ap:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25621
- 2026-10-03 Alias added: GHSA-qf23-6cwx-8x7w
References
More NEC Platforms, Ltd. vulnerabilities
- TI-2023-03494 OS command injection in NEC Platforms, Ltd. ITK-6DGS-1 TEL CVSS 3.1CRITICAL 9.8
- TI-2024-02823 NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an… CVSS 3.1CRITICAL 9.1
- TI-2026-07601 OS command injection in NEC Platforms, Ltd. Aterm MR51FN CVSS 4.0HIGH 8.5
- TI-2020-04602 OS command injection in NEC Corporation Aterm SA3500G CVSS 3.1HIGH 8.8
- TI-2018-00570 Improper privilege management in NEC Platforms, Ltd. Calsos CSDX and CSDJ series products CVSS 3.0HIGH 8.8
- TI-2026-04024 OS command injection in NEC Platforms, Ltd. Aterm WG2600HS CVSS 4.0HIGH 7.1
Sources
- CVE-2022-25621 · CVE Program
- CVE-2022-25621 · NVD
- FIRST EPSS
- GHSA-qf23-6cwx-8x7w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences