Nec Aterm HC100RC Firmware vulnerabilities

8 CVEs affecting Nec Aterm HC100RC Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-0641, published 2019-01-09.

More from Nec.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-0641, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter, time parameter, and offset parameter.
• CVE-2018-0640, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, time parameter, and offset parameter.
• CVE-2018-0639, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time parameter, and offset parameter.
• CVE-2018-0638, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter.
• CVE-2018-0637, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter.
• CVE-2018-0636, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634.
• CVE-2018-0635, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.
• CVE-2018-0634, published 2019-01-09. High severity, CVSS 7.2. EPSS: 1.4% chance of exploitation in the next 30 days. Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode parameter of a certain URL.