CVE-2024-28008

criticalpriority · track · 0OT risk · elevatedEPSS 0.006 · 50 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.62% (50th) EPSS

CVSS 9.8 · critical

Is it mine?

177 products

Check your exposure

Who says so?

2 sources

cnnvd · enisa_euvd

EPSS · scored 2026-10-28

Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN MR02LN, WG1810HP(JE) and WG1810HP(MF) all versions allows a attacker to execute an arbitrary OS command via the internet.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-489US

affected products (177)

Products and version ranges known to be affected.

NEC Corporation CR2500P≤ all versionsenisa_euvdEU
NEC Corporation CR2500Pall versionsenisa_euvdEU
NEC Corporation MR01LN≤ all versionsenisa_euvdEU
NEC Corporation MR01LNall versionsenisa_euvdEU
NEC Corporation MR02LN≤ all versionsenisa_euvdEU
NEC Corporation MR02LNall versionsenisa_euvdEU
NEC Corporation W1200EX(-MS)all versionsenisa_euvdEU
NEC Corporation W1200EX(-MS)≤ all versionsenisa_euvdEU
NEC Corporation W300P≤ all versionsenisa_euvdEU
NEC Corporation W300Pall versionsenisa_euvdEU
NEC Corporation WF1200HPall versionsenisa_euvdEU
NEC Corporation WF1200HP≤ all versionsenisa_euvdEU
NEC Corporation WF1200HP2all versionsenisa_euvdEU
NEC Corporation WF1200HP2≤ all versionsenisa_euvdEU
NEC Corporation WF300HPall versionsenisa_euvdEU
NEC Corporation WF300HP≤ all versionsenisa_euvdEU
NEC Corporation WF300HP2all versionsenisa_euvdEU
NEC Corporation WF300HP2≤ all versionsenisa_euvdEU
NEC Corporation WF800HP≤ all versionsenisa_euvdEU
NEC Corporation WF800HPall versionsenisa_euvdEU

showing 20 of 177

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd NVD CVE.org MITRE

published 2024-03-28modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan