CVE-2018-0628
Description
Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Aterm WG1200HP firmware ≤1.0.31 allows authenticated administrators to execute arbitrary OS commands via HTTP requests.
Vulnerability
Aterm WG1200HP firmware versions Ver1.0.31 and earlier contain multiple OS command injection vulnerabilities (CWE-78) in the handling of HTTP requests and responses [1]. An attacker must have administrative privileges to reach the vulnerable code path.
Exploitation
An attacker with network access (adjacent network, per CVSS v3 vector AV:A) and valid administrator credentials can send a specially crafted HTTP request containing injected OS commands [1]. No user interaction is required beyond the initial authentication.
Impact
Successful exploitation allows the attacker to execute arbitrary OS commands on the device with the privileges of the web server [1]. This results in full compromise of confidentiality, integrity, and availability of the affected device.
Mitigation
NEC Corporation has released a firmware update to address these vulnerabilities [1]. Users should apply the latest firmware version as provided by the vendor. No workarounds are documented in the available reference.
AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2<=1.0.31+ 1 more
- (no CPE)range: <=1.0.31
- (no CPE)range: firmware Ver1.0.31 and earlier
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- jvn.jp/en/jp/JVN00401783/index.htmlmitrethird-party-advisoryx_refsource_JVN
- jpn.nec.com/security-info/secinfo/nv18-011.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.