CVE-2025-0355

highpriority · track · 0OT risk · elevatedEPSS 0.005 · 46 %ileEUJP

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.54% (46th) EPSS

CVSS 7.5 · high

Is it mine?

9 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · jvndb

EPSS · scored 2026-10-28

Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS Ver.1.5.0 and earlier, GB1200PE Ver.1.3.0 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, WG2600HS2 Ver.1.3.2 and earlier, WX3000HP Ver.2.4.2 and earlier and WX4200D5 Ver.1.2.4 and earlier allows a attacker to get a Wi-Fi password via the network.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · psirt-info@cyber.jp.nec.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306US

affected products (9)

Products and version ranges known to be affected.

NEC Corporation GB1200PE≤ Ver.1.3.0 and earlierenisa_euvdEU
NEC Corporation WF1200CR≤ Ver.1.6.0 and earlierenisa_euvdEU
NEC Corporation WG1200CR≤ Ver.1.5.0 and earlierenisa_euvdEU
NEC Corporation WG2600HM4≤ Ver.1.4.2 and earlierenisa_euvdEU
NEC Corporation WG2600HP4≤ Ver.1.4.2 and earlierenisa_euvdEU
NEC Corporation WG2600HS≤ Ver.1.7.2 and earlierenisa_euvdEU
NEC Corporation WG2600HS2≤ Ver.1.3.2 and earlierenisa_euvdEU
NEC Corporation WX3000HP≤ Ver.2.4.2 and earlierenisa_euvdEU
NEC Corporation WX4200D5≤ Ver.1.2.4 and earlierenisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

JVNDB-2025-000002JVN iPedia advisory JVNDB-2025-0000022025-02-14vendor · jvndbJP

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd jvndb NVD CVE.org MITRE

published 2025-01-15modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan