CVE-2023-3333 Command injection in Aterm WF300HP

High 7.2 Published 28 Jun 2023 Updated 4 Dec 2024

Attackers with high privileges can execute arbitrary OS commands as root on NEC Aterm routers via improper neutralization of special elements.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-3333?

CVE-2023-3333 is a high-severity command injection vulnerability in NEC Corporation Aterm WF300HP, published on 28 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to execute an arbitrary OS command with the root privilege, after obtaining a high privilege exploiting CVE-2023-3330 and CVE-2023-3331 vulnerabilities.

Weakness: CWE-78

Which versions are affected by CVE-2023-3333?

It affects 17 products.

Products include Nec Aterm Wf300hp Firmware, Nec Aterm Wg1400hp Firmware, Nec Aterm Wg1800hp2 Firmware, Nec Aterm Wg1800hp Firmware, Nec Aterm Wg2200hp Firmware, Nec Aterm Wg2600hp2 Firmware and 11 more.

How do I fix CVE-2023-3333?

No fix has been published for CVE-2023-3333 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-3333 being exploited?

There is no known exploitation of CVE-2023-3333 in the wild and no public exploit code.

Sources

Also known as GHSA-4cvh-grfr-3h7q.