How to fix or mitigate EUVD-2026-16591?

Within 24 hours: inventory all NEC Aterm router deployments and document affected models and firmware versions currently in use. Within 7 days: contact NEC for patch availability and timeline; implement network segmentation to restrict administrative access to routers from trusted IP ranges only. Within 30 days: monitor NEC security advisories for patch release; prepare deployment procedures and test patches in non-production environments before broad rollout.

Aterm Wg2600Hs EUVD-2026-16591

Q: What is the CVSS score of EUVD-2026-16591?

EUVD-2026-16591 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-4622 HIGH

OS Command Injection (CWE-78)

2026-03-27 NEC

Command Injection Aterm Wg2600Hs Aterm Wf1200Cr Aterm Wg1200Cr Aterm Wg2600Hp4 Aterm Wg2600Hm4 Aterm Wg2600Hs2 Aterm Wx3000Hp Aterm Wx3000Hp2

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 15:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 27, 2026 - 12:15 euvd

EUVD-2026-16591

Analysis Generated

Mar 27, 2026 - 12:15 vuln.today

CVE Published

Mar 27, 2026 - 11:53 nvd

HIGH 7.1

DescriptionCVE.org

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

AnalysisAI

Multiple NEC Aterm wireless router models are vulnerable to OS command injection that enables network-based attackers with high privileges and user interaction to execute arbitrary operating system commands. The vulnerability carries a CVSS 4.0 score of 7.1 and affects at least eight router models in the Aterm series including WG2600HS, WF1200CR, WG1200CR, WG2600HP4, WG2600HM4, WG2600HS2, WX3000HP, and WX3000HP2. No public exploit identified at time of analysis, though exploitation requires both elevated privileges and user interaction which reduces immediate risk.

Technical ContextAI

This is a CWE-78 OS Command Injection vulnerability affecting the firmware of NEC Platforms Aterm-branded wireless routers and gateways. Command injection vulnerabilities occur when an application passes unsafe user-supplied data to a system shell, allowing attackers to append additional commands that execute with the privileges of the vulnerable application. The affected products include consumer and small business wireless routers spanning multiple model generations: cpe:2.3:a:nec_platforms,_ltd.:aterm_wg2600hs, aterm_wf1200cr, aterm_wg1200cr, aterm_wg2600hp4, aterm_wg2600hm4, aterm_wg2600hs2, aterm_wx3000hp, and aterm_wx3000hp2. Based on the network attack vector and router context, the vulnerability likely exists in the device's web management interface or administrative API where input validation fails to properly sanitize commands before passing them to underlying system calls.

RemediationAI

Consult the NEC security advisory at https://jpn.nec.com/security-info/secinfo/nv26-001_en.html for specific firmware updates addressing this vulnerability for each affected Aterm router model. Apply the latest firmware updates provided by NEC Platforms as soon as testing permits. Until patching is completed, restrict administrative access to the router management interface to trusted IP addresses only, disable remote management features if not required, enforce strong unique administrative passwords, implement network segmentation to isolate router management interfaces from general user networks, and monitor administrative access logs for suspicious activity. Consider deploying the routers behind additional network security controls if they must remain accessible for remote administration before patches can be applied.