Cyber Posture

CVE-2026-4620

Critical

Published: 27 March 2026

Published
27 March 2026
Modified
20 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2026-4620 by requiring timely identification, reporting, and patching of the OS command injection flaw in Aterm Series products.

prevent

Prevents exploitation of the command injection vulnerability by enforcing input validation at network entry points to block malicious command payloads.

prevent

Limits network-accessible exploitation of the unauthenticated command injection by monitoring and controlling communications to affected Aterm devices.

Security SummaryAI

CVE-2026-4620 is an OS Command Injection vulnerability (CWE-78) in NEC Platforms, Ltd.'s Aterm Series products. Published on 2026-03-27, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for severe impact.

The vulnerability enables a network-accessible attacker with no required privileges or user interaction to execute arbitrary OS commands on affected devices. Exploitation requires low complexity and can result in high confidentiality, integrity, and availability impacts, allowing full system compromise.

NEC Platforms has published an advisory with mitigation guidance at https://jpn.nec.com/security-info/secinfo/nv26-001_en.html.

Details

CWE(s)

Affected Products

nec
aterm wx3600hp firmware
≤ 1.5.3
nec
aterm wx1500hp firmware
≤ 1.4.2

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

OS Command Injection in a public-facing network device enables unauthenticated remote exploitation (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References