Which versions of Aterm Wx1500Hp are affected by EUVD-2026-16587?

NEC Platforms Aterm wireless routers (WX1500HP and WX3600HP) contain an authenticated command injection vulnerability that allows high-privileged network users to execute arbitrary commands on…

How to fix or mitigate EUVD-2026-16587?

Within 24 hours: Inventory all NEC Aterm WX1500HP and WX3600HP devices in production and document their network roles and connectivity. Within 7 days: Restrict administrative access to these devices to a minimal set of trusted personnel and enforce strong password policies for router accounts; review administrative access logs for suspicious activity. Within 30 days: Monitor NEC Platforms security advisories for patch availability and plan replacement or retirement of affected models if patches remain unavailable.

Aterm Wx1500Hp EUVD-2026-16587

Q: What is the CVSS score of EUVD-2026-16587?

EUVD-2026-16587 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-4620 HIGH

OS Command Injection (CWE-78)

2026-03-27 NEC

Command Injection Aterm Wx1500Hp Aterm Wx3600Hp

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 15:22 vuln.today

cvss_changed

EUVD ID Assigned

Mar 27, 2026 - 12:15 euvd

EUVD-2026-16587

Analysis Generated

Mar 27, 2026 - 12:15 vuln.today

CVE Published

Mar 27, 2026 - 11:53 nvd

HIGH 7.1

DescriptionCVE.org

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

AnalysisAI

OS command injection in NEC Platforms Aterm wireless router series (models WX1500HP and WX3600HP) permits authenticated network attackers with high privileges to execute arbitrary operating system commands on affected devices. The vulnerability requires user interaction and high attack complexity (CVSS 4.0 score 7.1), with no public exploit identified at time of analysis. NEC Platforms has published a security advisory detailing the issue.

Technical ContextAI

This vulnerability affects NEC Platforms Aterm wireless access point/router products, specifically the WX1500HP and WX3600HP models (confirmed via CPE cpe:2.3:a:nec_platforms,_ltd.:aterm_wx1500hp and cpe:2.3:a:nec_platforms,_ltd.:aterm_wx3600hp). The root cause is CWE-78 (OS Command Injection), a vulnerability class where unsanitized user input is passed to system shell commands. In enterprise networking equipment like these Aterm routers, command injection typically occurs through administrative web interfaces, CLI management, or configuration APIs where input validation fails to sanitize metacharacters before executing system-level operations. The CVSS 4.0 vector indicates network-based exploitation requiring high privileges (PR:H) and user interaction (UI:A), suggesting the vulnerability likely exists in privileged administrative functions rather than unauthenticated interfaces.

RemediationAI

Consult the official NEC Platforms security advisory at https://jpn.nec.com/security-info/secinfo/nv26-001_en.html for firmware updates and specific remediation guidance for Aterm WX1500HP and WX3600HP models. The vendor advisory should specify patched firmware versions and upgrade procedures. Until patching is completed, implement compensating controls including restricting administrative interface access to trusted management networks only (not exposed to general user networks or internet), enforcing strong authentication for administrative accounts with multi-factor authentication where supported, auditing administrative access logs for suspicious command execution patterns, and reviewing privileged user accounts to ensure principle of least privilege. Organizations unable to patch immediately should consider isolating affected devices on dedicated management VLANs with strict firewall rules limiting access to authorized administrators only.