Cyber Resilience

CVE-2023-3330

Medium

Published: 28 June 2023

Published
28 June 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0013 31.4th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-3330 is a medium-severity Path Traversal (CWE-22) vulnerability in Nec Aterm Wf300Hp Firmware. Its CVSS base score is 4.3 (Medium).

Operationally, ranked at the 31.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to obtain specific…

more

files in the product.

CWE(s)
CWE-22

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nec
aterm wf300hp firmware
all versions
nec
aterm wg1400hp firmware
all versions
nec
aterm wg1800hp firmware
all versions
nec
aterm wg1800hp2 firmware
all versions
nec
aterm wg2200hp firmware
all versions
nec
aterm wg2600hp firmware
all versions
nec
aterm wg2600hp2 firmware
all versions
nec
aterm wg300hp firmware
all versions
nec
aterm wg600hp firmware
all versions
nec
aterm wr8600n firmware
all versions
+7 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References