CVE-2024-28008

Command execution via active Telnet debug interface

Published Mar 28, 2024 · Updated Jan 14, 2025

Active debug code in all versions of affected NEC Aterm routers allows remote authenticated users to execute arbitrary OS commands through Telnet. The firmware leaves a Telnet debug function enabled and passes commands received through that interface to the operating system. Reachability requires LAN access and high privileges; NEC states that the flaw cannot be attacked from the WAN over an Internet connection.

CVSS severity9.8
Critical
EPSS probability0.62%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Active debug code in all versions of affected NEC Aterm routers allows remote authenticated users to execute arbitrary OS commands through Telnet. The firmware leaves a Telnet debug function enabled and passes commands received through that interface to the operating system. Reachability requires LAN access and high privileges; NEC states that the flaw cannot be attacked from the WAN over an Internet connection.

The record

CVE
CVE-2024-28008
Published
Mar 28, 2024
Updated
Jan 14, 2025
Vendor
NEC Corporation
Product
Aterm WR8600N
Classifications
CWE-489, T1059.008
Attack vector
adjacent
Privileges
admin

Timeline

How it unfolded

  1. Mar 28, 2024CVE publishedPublication date reported by the CVE source.
  2. Jan 14, 2025Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=all versions

What conditions does exploitation require?

Attack vectoradjacent
Required privilegesadmin

What is affected?

NEC Corporation · Aterm WR8600Nversion=all versions
NEC Platforms, Ltd. · Aterm W300Pversion=all versions
NEC Platforms, Ltd. · Aterm WG2200HPversion=all versions
NEC Corporation · Aterm WR8300Nversion=all versions
NEC Platforms, Ltd. · Aterm WR6670Sversion=all versions
NEC Platforms, Ltd. · Aterm WR1200Hversion=all versions
NEC Platforms, Ltd. · Aterm WR7800Hversion=all versions
NEC Platforms, Ltd. · Aterm WG1800HP2version=all versions
NEC Platforms, Ltd. · Aterm WG1200HS3version=all versions
NEC Platforms, Ltd. · Aterm WG1810HP(JE)version=all versions
NEC Platforms, Ltd. · Aterm WG1800HPversion=all versions
NEC Platforms, Ltd. · Aterm WR4500Nversion=all versions
NEC Platforms, Ltd. · Aterm WF800HPversion=all versions
NEC Corporation · Aterm WR8175Nversion=all versions
NEC Platforms, Ltd. · Aterm WG1900HPversion=all versions
NEC Platforms, Ltd. · Aterm WM3800Rversion=all versions
NEC Platforms, Ltd. · Aterm WG1800HP4version=0 <=*; version=all versions
NEC Corporation · Aterm WR8750Nversion=all versions
NEC Platforms, Ltd. · Aterm MR01LNversion=all versions
NEC Platforms, Ltd. · Aterm WG1800HP3version=all versions
NEC Platforms, Ltd. · Aterm WG600HPversion=all versions
NEC Platforms, Ltd. · Aterm MR02LNversion=all versions
NEC Corporation · Aterm WR7850Sversion=all versions
NEC Platforms, Ltd. · Aterm WG1200HSversion=all versions
NEC Corporation · Aterm WR8150Nversion=all versions
NEC Corporation · Aterm WR8400Nversion=all versions
NEC Corporation · Aterm WR8165Nversion=all versions
NEC Platforms, Ltd. · Aterm WR6600Hversion=all versions
NEC Corporation · Aterm WR8370Nversion=all versions
NEC Platforms, Ltd. · Aterm WG1900HP2version=all versions
NEC Corporation · Aterm WR8100Nversion=all versions
NEC Platforms, Ltd. · Aterm WF300HP2version=all versions
NEC Platforms, Ltd. · Aterm WG1400HPversion=all versions
NEC Platforms, Ltd. · Aterm WF1200HP2version=all versions
NEC Platforms, Ltd. · Aterm WM3600Rversion=all versions
NEC Corporation · Aterm WR8500Nversion=all versions
NEC Platforms, Ltd. · Aterm W1200EX-MSversion=all versions
NEC Platforms, Ltd. · Aterm WF300HPversion=all versions
NEC Corporation · Aterm WR8700Nversion=all versions
NEC Corporation · Aterm WR8170Nversion=all versions
NEC Platforms, Ltd. · Aterm WM3450RNversion=all versions
NEC Platforms, Ltd. · Aterm WR4100Nversion=all versions
NEC Corporation · Aterm WR9300Nversion=all versions
NEC Platforms, Ltd. · Aterm CR2500Pversion=all versions
NEC Platforms, Ltd. · Aterm WM3400RNversion=all versions
NEC Platforms, Ltd. · Aterm WF1200HPversion=all versions
NEC Platforms, Ltd. · Aterm WG1200HP2version=all versions
NEC Platforms, Ltd. · Aterm WG1200HP3version=all versions
NEC Corporation · Aterm WR8166Nversion=all versions
NEC Platforms, Ltd. · Aterm WG300HPversion=all versions
NEC Corporation · Aterm WR8200Nversion=all versions
NEC Corporation · Aterm WR9500Nversion=all versions
NEC Platforms, Ltd. · Aterm WM3500Rversion=all versions
NEC Platforms, Ltd. · Aterm WG1810HP(MF)version=all versions
NEC Platforms, Ltd. · Aterm WR6650Sversion=all versions
NEC Corporation · Aterm WR7870Sversion=all versions
NEC Corporation · Aterm WR8160Nversion=all versions
NEC Platforms, Ltd. · Aterm WG1200HS2version=all versions
NEC Platforms, Ltd. · Aterm WG1200HPversion=all versions

Published CVSS scores

9.8CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectoradjacent
Privilegesadmin
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-489Active Debug Code
T1059.008Network Device CLI

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo