CVE-2020-5524
Last modified
CVE-2020-5524 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nec | Aterm Wg2600hs Firmware | <= 1.3.2 |
| Nec | Aterm Wf1200c Firmware | <= 1.2.1 |
| Nec | Aterm Wg1200cr Firmware | <= 1.2.1 |
References
- https://jpn.nec.com/security-info/secinfo/nv20-003.htmlNot Applicable, Third Party Advisory
- https://jvn.jp/en/jp/JVN49410695/index.htmlNot Applicable, Third Party Advisory
- https://jvn.jp/en/jp/JVN25766797/Third Party Advisory
- https://jpn.nec.com/security-info/secinfo/nv20-003.htmlNot Applicable, Third Party Advisory
- https://jvn.jp/en/jp/JVN49410695/index.htmlNot Applicable, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-5524?
How severe is CVE-2020-5524?
How do I fix CVE-2020-5524?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5517CSRF in the /login URI in BlueOnyx 5209R allows an attacker …6.5
- CVE-2020-5519The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not…9.8
- CVE-2020-5520The netprint App for iOS 3.2.3 and earlier does not verify X…7.4
- CVE-2020-5521The kantan netprint App for iOS 2.0.2 and earlier does not v…7.4
- CVE-2020-5522The kantan netprint App for Android 2.0.3 and earlier does n…7.4
- CVE-2020-5523Android App 'MyPallete' and some of the Android banking appl…7.4
- CVE-2020-5525Aterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, A…8
- CVE-2020-5526The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2…5.9
- CVE-2020-5527When MELSOFT transmission port (UDP/IP) of Mitsubishi Electr…7.5
- CVE-2020-5528Cross-site scripting vulnerability in Movable Type series (M…6.1
- CVE-2020-5529HtmlUnit prior to 2.37.0 contains code execution vulnerabili…8.1
- CVE-2020-5530Cross-site request forgery (CSRF) vulnerability in Easy Prop…8.8
Are you affected by CVE-2020-5524?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST