Cross-site scripting in NEC Corporation Aterm WG2600HP2
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Improper Neutralization of Input During Web Page Generation vulnerability in NEC Corporation Aterm Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary script, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00347 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NEC Corporation | Aterm WG2600HP2 | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG2600HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG2200HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG2200HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG1800HP2 | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG1800HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG1400HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG600HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WG300HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WF300HP | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR9500N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR9300N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8750N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8700N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8600N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8370N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8175N | all versions | — | No fix listed | CNA |
| NEC Corporation | Aterm WR8170N | all versions | — | No fix listed | CNA |
- Aterm WG2600HP2 VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG2600HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG2200HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG2200HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG1800HP2 VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG1800HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG1400HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG600HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WG300HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WF300HP VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR9500N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR9300N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8750N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8700N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8600N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8370N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8175N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
- Aterm WR8170N VendorNEC Corporation Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:nec:aterm_wf300hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wf300hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg1400hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg1400hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg1800hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg1800hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg1800hp2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg1800hp2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg2200hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg2200hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
- cpe:2.3:o:nec:aterm_wf300hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wf300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg1400hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg1400hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg1800hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg1800hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg1800hp2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg1800hp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg2200hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg2200hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:nec:aterm_wg2600hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg2600hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg2600hp2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg2600hp2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg300hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg300hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wg600hp_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wg600hp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8600n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8600n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8700n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8700n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8750n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8750n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr9300n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr9300n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr9500n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr9500n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8170n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8170n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8175n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8175n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
| cpe:2.3:o:nec:aterm_wr8370n_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NEC Corporation |
| cpe:2.3:h:nec:aterm_wr8370n:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NEC Corporation |
- cpe:2.3:o:nec:aterm_wg2600hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg2600hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg2600hp2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg2600hp2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg300hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg300hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wg600hp_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wg600hp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8600n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8600n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8700n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8700n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8750n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8750n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr9300n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr9300n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr9500n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr9500n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8170n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8170n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8175n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8175n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
- cpe:2.3:o:nec:aterm_wr8370n_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NEC Corporation
- cpe:2.3:h:nec:aterm_wr8370n:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NEC Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3332
- 2026-10-03 Alias added: GHSA-375r-f934-jp9v
References
More NEC Corporation Aterm Wf300hp Firmware vulnerabilities
- TI-2024-18613 Improper authentication in NEC Corporation WG1800HP4 CVSS 3.1CRITICAL 9.8
- TI-2024-18612 Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3… CVSS 3.1CRITICAL 9.8
- TI-2024-18610 Improper authentication in NEC Corporation WG1800HP4 CVSS 3.1CRITICAL 9.8
- TI-2024-18616 OS command injection in NEC Corporation WG1800HP4 CVSS 3.1CRITICAL 9.8
- TI-2024-18615 Stack-based buffer overflow in NEC Corporation WG1800HP4 CVSS 3.1CRITICAL 9.8
- TI-2024-18611 Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-3332 · CVE Program
- CVE-2023-3332 · NVD
- FIRST EPSS
- GHSA-375r-f934-jp9v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences