Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 4 products
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-04-03 | 1 | Patch1 |
| 2026-04-04 | 2 | General2 |
CVE-2026-4620 OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network. https://www.cve.org/CVERecord?id=CVE-2026-4620
Post summary
The post announces a new OS command injection vulnerability (CVE‑2026‑4620) in NEC Aterm Series that permits remote execution of arbitrary OS commands.
・任意のOSコマンドを実行される（CVE-2026-4620／CVE-2026-4622） その時喰らったのが恐らくこれ 自分が管理している端末の接続数が2台オーバーしていた MACアドレス的なやつからPCなのかスマホなのかゲームなのか ひとつひとつ見ていったけど それが結局なんであるかすらもわからなかった
Post summary
The user reports experiencing an incident likely linked to CVE-2026-4620/4622, which allows arbitrary OS command execution, but provides no evidence of PoC, exploit code, patches, or active exploitation.
いろいろヤバすぎる "●想定される影響（一例） ・装置固有の情報を取得され、結果として設定を変更される（CVE-2026-4309） ・任意のファイルを上書きされる（CVE-2026-4619） ・任意のOSコマンドを実行される（CVE-2026-4620／CVE-2026-4622） ・telnetサービスを有効化される（CVE-2026-4621）"
Post summary
The post lists potential impacts for several CVEs but does not provide POc, exploit code, active exploitation evidence, patches, or detailed technical specifics beyond high‑level impact descriptions.
⚠️ **Vulnerability Alert:** NEC Aterm Series — Multiple Vulnerabilities (CVE-2026-4309, CVE-2026-4619, CVE-2026-4620, CVE-2026-4621, CVE-2026-4622) 📅 **Timeline:** Disclosure: 2026-03-27, Patch: Not Available 🆔 **CVE-2026-4309** | 📊 CVSS: 6.3 (MEDIUM 🟡) | 📈 EPSS: 17.00% 🆔 **CVE-2026-4619** | 📊 CVSS: 6.0 (MEDIUM 🟡) | 📈 EPSS: 17.66% 🆔 **CVE-2026-4620** | 📊 CVSS: 7.1 (HIGH 🟠) | 📈 EPSS: 61.72% 🆔 **CVE-2026-4621** | 📊 CVSS: 6.3 (MEDIUM 🟡) | 📈 EPSS: 18.23% 🆔 **CVE-2026-4622** | 📊 CVSS: 7.1 (HIGH 🟠) | 📈 EPSS: 61.72% 🛠️ **Exploit Maturity:** Not Available 🫨 **Attack Vectors:** - Network (remote) - Some issues require elevated privileges (PR:H) - OS command injection variants may require user interaction (UI:A) 📝 **Summary:** Multiple flaws in NEC Aterm devices allow info disclosure, unauthorized config changes, arbitrary file overwrite, and OS command injection that can lead to remote code execution and full device compromise; some issues can also enable telnet. Root causes are insufficient authorization checks and improper input validation—patches are not yet widely available. 📈 **Impact Scope:** Disclosure of device-specific information; unauthorized configuration changes; arbitrary file overwrite; arbitrary OS command execution leading to remote code execution and full device compromise; enabling telnet service increasing exposure. Affects multiple NEC Aterm models (see vendor advisory for model-specific details). 🛡️ **Recommended Actions:** - Apply vendor-provided patches per model immediately; if unavailable, isolate management interfaces via firewall/VLANs. - Disable remote management and telnet, change default credentials, inventory devices, backup configs, and monitor logs for suspicious activity. 🪢 **Related Resources:** - https://jvn.jp/jp/JVN89339669/ - https://jvndb.jvn.jp/jvndb/JVNDB-2026-000049 🏷 **Tags:** #Cybersecurity #NEC #Aterm
Post summary
The post outlines multiple CVEs in NEC Aterm devices, provides detailed technical and impact information, and offers mitigation steps, but it does not present proof of exploitation or an active threat.
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | nec | aterm_wx1500hp | - | - | - |
| OS | nec | aterm_wx1500hp_firmware | - | - | - |
| HW | nec | aterm_wx3600hp | - | - | - |
| OS | nec | aterm_wx3600hp_firmware | - | - | - |