Vulnerabilities > NEC

DATE CVE VULNERABILITY TITLE RISK
2020-12-24 CVE-2020-5684 Improper Certificate Validation vulnerability in NEC ISM Server
iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.
network
nec CWE-295
5.8
2020-10-06 CVE-2020-5632 Unspecified vulnerability in NEC Infocage Siteshell 1.4/1.5/1.6
InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.
local
low complexity
nec
7.2
2020-09-10 CVE-2020-17408 XXE vulnerability in NEC Expresscluster X 4.1/4.2
This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.
network
low complexity
nec CWE-611
5.0
2020-07-29 CVE-2019-20033 Insufficiently Protected Credentials vulnerability in NEC Sv8100 Firmware
On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface.
network
low complexity
nec CWE-522
7.5
2020-07-29 CVE-2019-20032 Unspecified vulnerability in NEC products
An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem.
network
low complexity
nec
4.0
2020-07-29 CVE-2019-20031 Improper Restriction of Excessive Authentication Attempts vulnerability in NEC Um8000 Firmware and Um4730 Firmware
NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.
network
low complexity
nec CWE-307
6.4
2020-07-29 CVE-2019-20030 Unspecified vulnerability in NEC Um8000 Firmware
An attacker with knowledge of the modem access number on a NEC UM8000 voicemail system may use SSH tunneling or standard Linux utilities to gain access to the system's LAN port.
local
low complexity
nec
4.6
2020-07-29 CVE-2019-20029 Improper Privilege Management vulnerability in NEC products
An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices.
network
low complexity
nec CWE-269
6.5
2020-07-29 CVE-2019-20028 Information Exposure vulnerability in NEC products
Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface.
network
low complexity
nec CWE-200
5.0
2020-07-29 CVE-2019-20027 Improper Authentication vulnerability in NEC products
Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account.
network
low complexity
nec CWE-287
7.5