Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP,…

Description

Improper Limitation of a Pathname to a Restricted Directory vulnerability in NEC Corporation Aterm WG2600HP2, WG2600HP, WG2200HP, WG1800HP2, WG1800HP, WG1400HP, WG600HP, WG300HP, WF300HP, WR9500N, WR9300N, WR8750N, WR8700N, WR8600N, WR8370N, WR8175N and WR8170N all versions allows a attacker to obtain specific files in the product.

Scores

EPSS (exploitation in 30 days)

0.51% · top 56% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory (opens in a new tab)All about CWE-22 and its CVEs

Affected products

• NEC Corporation · Aterm WG2600HP2

  • affected all versions

• NEC Corporation · Aterm WG2600HP

  • affected all versions

• NEC Corporation · Aterm WG2200HP

  • affected all versions

• NEC Corporation · Aterm WG2200HP

  • affected all versions

• NEC Corporation · Aterm WG1800HP2

  • affected all versions

• NEC Corporation · Aterm WG1800HP

  • affected all versions

• NEC Corporation · Aterm WG1400HP

  • affected all versions

• NEC Corporation · Aterm WG600HP

  • affected all versions

• NEC Corporation · Aterm WG300HP

  • affected all versions

• NEC Corporation · Aterm WF300HP

  • affected all versions

• NEC Corporation · Aterm WR9500N

  • affected all versions

• NEC Corporation · Aterm WR9300N

  • affected all versions

• NEC Corporation · Aterm WR8750N

  • affected all versions

• NEC Corporation · Aterm WR8700N

  • affected all versions

• NEC Corporation · Aterm WR8600N

  • affected all versions

• NEC Corporation · Aterm WR8370N

  • affected all versions

• NEC Corporation · Aterm WR8175N

  • affected all versions

• NEC Corporation · Aterm WR8170N

  • affected all versions

What to do

Workaround: Stop using the products or remove the USB storage.

References (1)

• https://jpn.nec.com/security-info/secinfo/nv23-007_en.html (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-3330](https://trackcve.app/badge/CVE-2023-3330.svg)](https://trackcve.app/cve/CVE-2023-3330)

Record last updated 4 Dec 2024, 21:42 UTC.