CVE-2025-0355

Estado: AplazadaAlta (7.5)—

Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.54%
Percentil entre todas las CVEs puntuadas: 43
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1552.001 Credentials In Filescredential access90 %
Impacto secundarioT1078.002 Domain Accountsstealth · persistence · privilege escalation · initial access75 %

Router ATERM expone función crítica (obtención de contraseña Wi-Fi) sin autenticación en red (AV:N, PR:N, UI:N). Acceso remoto no autenticado a datos sensibles (C:H). Compromete credenciales de red (T1552.001) y acceso a cuentas Wi-Fi (T1078.002).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Training Privileged Account Management Password Policies Vulnerability Scanning User Account Management Restrict File and Directory Permissions

Tecnologías afectadas (9)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

NEC Corporation — Aterm Gb1200pe^AI NEC Corporation — Aterm Wf1200crs^AI NEC Corporation — Aterm Wg1200crs^AI NEC Corporation — Aterm Wg2600hm4^AI NEC Corporation — Aterm Wg2600hp4^AI NEC Corporation — Aterm Wg2600hs^AI NEC Corporation — Aterm Wg2600hs2^AI NEC Corporation — Aterm Wx3000hp^AI NEC Corporation — Aterm Wx4200d5^AI

CWE

CWE-306

Referencias

https://jpn.nec.com/security-info/secinfo/nv25-003_en.html

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-0355",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0355",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-15T15:01:29.278695Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt-info@cyber.jp.nec.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt-info@cyber.jp.nec.com",
      "affectedData": [
        {
          "vendor": "NEC Corporation",
          "product": "WG2600HS",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.7.2 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WF1200CR",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.6.0 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WG1200CR",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.5.0 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "GB1200PE",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.3.0 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WG2600HP4",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.4.2 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WG2600HM4",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.4.2 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WG2600HS2",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.3.2 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WX3000HP",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.2.4.2 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "NEC Corporation",
          "product": "WX4200D5",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.1.2.4 and earlier"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-01-15T08:15:26.493",
  "references": [
    {
      "url": "https://jpn.nec.com/security-info/secinfo/nv25-003_en.html",
      "source": "psirt-info@cyber.jp.nec.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt-info@cyber.jp.nec.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de falta de autenticación para funciones críticas en NEC Corporation Aterm WG2600HS Ver.1.7.2 y anteriores, WF1200CRS Ver.1.6.0 y anteriores, WG1200CRS Ver.1.5.0 y anteriores, GB1200PE Ver.1.3.0 y anteriores, WG2600HP4 Ver.1.4.2 y anteriores, WG2600HM4 Ver.1.4.2 y anteriores, WG2600HS2 Ver.1.3.2 y anteriores, WX3000HP Ver.2.4.2 y anteriores y WX4200D5 Ver.1.2.4 y anteriores permite a un atacante obtener una contraseña de Wi-Fi a través de Internet."
    }
  ],
  "lastModified": "2026-06-17T08:26:20.323",
  "sourceIdentifier": "psirt-info@cyber.jp.nec.com"
}