CVE-2021-20680

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-26 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP firmware Ver.2.5.1 and earlier, Aterm WG1800HP4 firmware Ver.1.3.1 and earlier, Aterm WG1800HP3 firmware Ver.1.5.1 and earlier, Aterm WG1200HS2 firmware Ver.2.5.0 and earlier, Aterm WG1200HP3 firmware Ver.1.3.1 and earlier, Aterm WG1200HP2 firmware Ver.2.5.0 and earlier, Aterm W1200EX firmware Ver.1.3.1 and earlier, Aterm W1200EX-MS firmware Ver.1.3.1 and earlier, Aterm WG1200HS firmware all versions Aterm WG1200HP firmware all versions Aterm WF800HP firmware all versions Aterm WF300HP2 firmware all versions Aterm WR8165N firmware all versions Aterm W500P firmware all versions, and Aterm W300P firmware all versions) allows remote attackers to inject arbitrary script or HTML via unspecified vectors.

Affected products

NEC Aterm W1200Ex-Ms Firmware: through 1.3.1
NEC Aterm W1200Ex Firmware: through 1.3.1
NEC Corporation Aterm W300P: all versions
NEC Aterm W500P Firmware: all versions
NEC Aterm Wf300Hp2 Firmware: all versions
NEC Aterm Wf800Hp Firmware: all versions
NEC Aterm Wg1200Hp2 Firmware: through 2.5.0
NEC Aterm Wg1200Hp3 Firmware: through 1.3.1
NEC Corporation WG1200HP: all versions
NEC Aterm Wg1200Hs2 Firmware: through 2.5.0
NEC Aterm Wg1200Hs3 Firmware: through 1.1.2
NEC Aterm Wg1200Hs Firmware: all versions
NEC Aterm Wg1800Hp3 Firmware: through 1.5.1
NEC Aterm Wg1800Hp4 Firmware: through 1.3.1
NEC Aterm Wg1900Hp2 Firmware: through 1.3.1
NEC Aterm Wg1900Hp Firmware: through 2.5.1
NEC Aterm Wr8165N Firmware: all versions

References

Get alerted when CVE-2021-20680 or the next vulnerability affects your stack