Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-20621: Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authenticati...

CVE-2021-20621 · published 5 years ago

Summary

Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
aterm	wg2600hp_firmware	<= 1.0.2 `cpe:2.3:o:aterm:wg2600hp_firmware::::::::`
aterm	wg2600hp2_firmware	<= 1.0.2 `cpe:2.3:o:aterm:wg2600hp2_firmware::::::::`

Original advisory text

References

https://jpn.nec.com/security-info/secinfo/nv21-005.html Third Party Advisory
https://jvn.jp/en/jp/JVN38248512/index.html Third Party Advisory
https://www.aterm.jp/support/tech/2019/0328.html Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published28 Jan 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-20621 · NVD

Track software like this

Free during beta