CVE-2021-20709

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-26 · updated 2026-06-17
Weakness: CWE-354

Description

Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to a specific URL.

Affected products

NEC Aterm Wf1200Cr Firmware: through 1.3.2
NEC Aterm Wg1200Cr Firmware: through 1.3.3
NEC Corporation Aterm WG2600HS: through 1.5.1

References

https://jpn.nec.com/security-info/secinfo/nv21-010.html
https://jvn.jp/en/jp/JVN29739718/index.html
https://jpn.nec.com/security-info/secinfo/nv21-010.html
https://jvn.jp/en/jp/JVN29739718/index.html

Get alerted when CVE-2021-20709 or the next vulnerability affects your stack