CVE-2017-12575

Name of the Vulnerable Software and Affected Versions: NEC Aterm WG2600HP2 version 1.0.2

Description: An issue was discovered in the NEC Aterm WG2600HP2 router, which has a set of web service APIs for accessing and setting up the configuration. Some of these APIs do not require authentication, allowing an attacker to exploit this issue by sending a crafted HTTP request to retrieve sensitive information, such as DHCP clients, firmware version, and network status. For example, an attacker could use a command like curl -X http://[IP]/aterm httpif.cgi/negotiate -d "REQ ID=SUPPORT IF GET" to exploit this.

Recommendations: For NEC Aterm WG2600HP2 version 1.0.2, as a temporary workaround, consider restricting access to the aterm httpif.cgi API endpoint to minimize the risk of exploitation. Avoid using the REQ ID parameter with the value SUPPORT IF GET in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.