NEC Corporation vulnerabilities, page 3

89 vulnerabilities

Known vulnerabilities in NEC Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 114 products.

4.8MediumCVE-2025-0354nec corporation · wg2600hm4 +5 morenec corporation wg2600hm4Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to inject an arbitrary script via the network.EPSS0.23%7.5HighCVE-2025-0355nec corporation · gb1200pe +8 morenec corporation gb1200peMissing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.EPSS0.54%8.4HighCVE-2025-12852nec corporation · rakurakumusen start exnec corporation rakurakumusen start exDLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's device.EPSS0.15%5.1MediumCVE-2025-8153nec corporation · univerge ix +1 morenec corporation univerge ixCross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts may be executed on the user's browser.EPSS0.33%8.8HighCVE-2020-5635nec corporation · aterm sa3500g +1 morenec corporation aterm sa3500gAterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.EPSS1.06%6.8MediumCVE-2020-5637nec corporation · aterm sa3500g +1 morenec corporation aterm sa3500gImproper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to execute a malicious program.EPSS0.38%5.8MediumCVE-2020-5684nec corporation · management software for nec storage disk array system +1 morenec corporation management software for nec storage disk array systemiSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.EPSS0.34%8HighCVE-2020-5525nec corporation · aterm series +3 morenec corporation aterm seriesAterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen.EPSS0.87%6.1MediumCVE-2020-5533nec corporation · aterm wg2600hs +1 morenec corporation aterm wg2600hsCross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.EPSS0.80%7.5HighCVE-2020-5686nec corporation · univerge sv9500/sv8500 series +2 morenec corporation univerge sv9500/sv8500 seriesIncorrect implementation of authentication algorithm issue in UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to access the remote system maintenance feature and obtain the information by sending a specially crafted request to a specific URL.EPSS1.18%10CriticalCVE-2020-5685nec corporation · univerge sv9500/sv8500 series +2 morenec corporation univerge sv9500/sv8500 seriesUNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service (DoS) condition by sending a specially crafted request to a specific URL.EPSS1.82%9.8CriticalCVE-2020-5633nec corporation · multiple nec products where baseboard management controller (bmc) firmware rev1.09 and earlier is applied +1 morenec corporation multiple nec products where baseboard management controller (bmc) firmware rev1.09 and earlier is appliedMultiple NEC products (Express5800/T110j, Express5800/T110j-S, Express5800/T110j (2nd-Gen), Express5800/T110j-S (2nd-Gen), iStorage NS100Ti, and Express5800/GT110j) where Baseboard Management Controller (BMC) firmware Rev1.09 and earlier is applied allows remote attackers to bypass authentication and then obtain/modify BMC setting information, obtain monitoring information, or reboot/shut down the vulnerable product via unspecified vectors.EPSS3.22%6.8MediumCVE-2020-5636nec corporation · aterm sa3500g +1 morenec corporation aterm sa3500gAterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution.EPSS0.76%8.8HighCVE-2020-5524nec corporation · aterm series +3 morenec corporation aterm seriesAterm series (Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier) allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via UPnP function.EPSS1.02%7.8HighCVE-2020-5632nec corporation · infocage siteshell series +1 morenec corporation infocage siteshell seriesInfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.EPSS0.40%8HighCVE-2020-5534nec corporation · aterm wg2600hs +1 morenec corporation aterm wg2600hsAterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors.EPSS0.87%9.8CriticalCVE-2022-34825nec corporation · clusterpro x +2 morenec corporation clusterpro xUncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.EPSS1.32%9.8CriticalCVE-2022-34823nec corporation · clusterpro x +2 morenec corporation clusterpro xBuffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.EPSS1.38%9.8CriticalCVE-2022-34822nec corporation · clusterpro x +2 morenec corporation clusterpro xPath traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.EPSS1.53%9.8CriticalCVE-2022-34824nec corporation · clusterpro x +2 morenec corporation clusterpro xWeak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.EPSS1.21%