CVE-2020-5525: OS Command Injection
First published: Fri Feb 21 2020(Updated: )
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.
Credit: vultures@jpcert.or.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NEC Aterm WG2600HS firmware | <=1.3.2 | |
| NEC Aterm WG2600HS | ||
| Nec Aterm Wf1200c Firmware | <=1.2.1 | |
| Nec Aterm Wf1200c | ||
| Nec Aterm Wg1200cr Firmware | <=1.2.1 | |
| Nec Aterm Wg1200cr |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5525?
CVE-2020-5525 is a vulnerability in Aterm series, specifically the Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, and Aterm WG2600HS firmware Ver1.3.2 and earlier, which allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via the management screen.
What software is affected by CVE-2020-5525?
CVE-2020-5525 affects NEC Aterm WF1200C firmware versions up to and including Ver1.2.1, NEC Aterm WG1200CR firmware versions up to and including Ver1.2.1, and NEC Aterm WG2600HS firmware versions up to and including Ver1.3.2.
What is the severity of CVE-2020-5525?
CVE-2020-5525 has a severity rating of high (8 out of 10).
How can an attacker exploit CVE-2020-5525?
An authenticated attacker on the same network segment can exploit CVE-2020-5525 by executing arbitrary OS commands with root privileges via the management screen.
How can I fix CVE-2020-5525?
To fix CVE-2020-5525, it is recommended to update the Aterm series devices to the latest firmware versions that address this vulnerability.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/nec
- canonical/nec aterm wg2600hs firmware
- version/nec aterm wg2600hs firmware/1.3.2
- canonical/nec aterm wg2600hs
- canonical/nec aterm wf1200c firmware
- version/nec aterm wf1200c firmware/1.2.1
- canonical/nec aterm wf1200c
- canonical/nec aterm wg1200cr firmware
- version/nec aterm wg1200cr firmware/1.2.1
- canonical/nec aterm wg1200cr