Technical impact
A missing authorization check in NEC Platforms Aterm series routers allows an attacker who can reach the device through its network interfaces to retrieve detailed device information and modify configuration settings, all without valid credentials. This vulnerability can lead to unauthorized alteration of router behavior or exposure of sensitive device data. The weakness is classified as a missing authorization error.
Affected Systems
NEC Platforms Aterm Series routers, including models W1200EX, WF1200CR, WG1200CR, WG1200HP2 to HP4, WG1200HS2 to HS4, WG1800HP3 to HP4, WG1900HP to HP2, WG2600HM4 to HS2, and WX1500HP to WX3600HP. No specific firmware or version details are provided, so the entire model range may be affected.
Risk and Exploitability
The CVSS score of 6.3 indicates moderate severity. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to have network connectivity to the router, which could be local or remote if the device is exposed. No public exploitation data or known scripts are documented, so the current risk depends on the exposure of the router and the presence of an update to address the issue.
