Cyber Resilience

CVE-2023-3333

HighRCE

Published: 28 June 2023

Published
28 June 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.2th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-3333 is a high-severity OS Command Injection (CWE-78) vulnerability in Nec Aterm Wf300Hp Firmware. Its CVSS base score is 7.2 (High).

Operationally, ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute…

more

an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nec
aterm wf300hp firmware
all versions
nec
aterm wg1400hp firmware
all versions
nec
aterm wg1800hp firmware
all versions
nec
aterm wg1800hp2 firmware
all versions
nec
aterm wg2200hp firmware
all versions
nec
aterm wg2600hp firmware
all versions
nec
aterm wg2600hp2 firmware
all versions
nec
aterm wg300hp firmware
all versions
nec
aterm wg600hp firmware
all versions
nec
aterm wr8600n firmware
all versions
+7 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References