CVE-2025-0354

State: Published
Severity: 4.8 Medium
Published: Jan 15, 2025
Updated: Apr 3, 2025
Reserved: Jan 9, 2025

Description

Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.

Scores

CVSS	Score	Vector	Source
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N	NEC

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
WG2600HSNEC Corporation	Ver.1.7.2 and earlierAffected
WG2600HP4NEC Corporation	Ver.1.4.2 and earlierAffected
WG2600HM4NEC Corporation	Ver.1.4.2 and earlierAffected
WG2600HS2NEC Corporation	Ver.1.3.2 and earlierAffected
WX3000HPNEC Corporation	Ver.2.4.2 and earlierAffected
WX4200D5NEC Corporation	Ver.1.2.4 and earlierAffected

References

https://jpn.nec.com/security-info/secinfo/nv25-003_en.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.