NEC Aterm EUVD-2026-31623

Q: What is the CVSS score of EUVD-2026-31623?

EUVD-2026-31623 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-6059 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-25 NEC

GHSA-g9r3-rg2f-3r96

XSS Aterm Wx3000Hp2 Aterm Wx1800Hp Aterm Wx5400Hp Aterm Wx7800T8 Aterm Wx11000T12 Aterm Wx4200D5 Aterm Gx621A1 Aterm Sh621A1 Aterm 19000T12Be Nec Platforms Ltd

4.8

CVSS 4.0 · Vendor: NEC

Severity by source

Vendor (NEC) PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.2 MEDIUM

Adjacent attack vector per device architecture; no attacker privileges needed; user interaction required; scope changes to browser session enabling session theft (C:L) and DOM manipulation (I:L).

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (NEC).

CVSS VectorVendor: NEC

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:23 vuln.today

CVE Published

May 25, 2026 - 02:22 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

AnalysisAI

Cross-site scripting in NEC Aterm router web management interfaces allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of any user who visits the management UI. Nine router models across the Aterm WX, GX, SH, and 19000 series are confirmed affected, with patched firmware versions identified for each. No public exploit identified at time of analysis and EPSS sits at 0.03% (9th percentile), indicating very low observed exploitation pressure; CISA SSVC also assesses exploitation as none.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled input is reflected or stored without adequate sanitization and rendered as executable HTML/JavaScript in the browser. The vulnerability resides in the embedded HTTP-based web management interface common to embedded networking appliances. Affected products span nine NEC Platforms Ltd. Aterm models - WX1800HP, WX5400HP, WX7800T8, WX11000T12, WX3000HP2, WX4200D5, GX621A1, SH621A1, and 19000T12BE - all confirmed by CPE strings under the nec_platforms,_ltd. vendor namespace. The CVSS 4.0 attack vector AV:A (Adjacent) indicates the attacker must share the same network segment or VLAN as the targeted device; remote Internet-based exploitation is not directly possible without first gaining LAN access.

RemediationAI

Apply the vendor-released firmware updates: WX1800HP → Ver. 3.2.2, WX5400HP → Ver. 2.1.0, WX7800T8 → Ver. 1.5.1, WX11000T12 → Ver. 1.4.0, WX3000HP2 → Ver. 1.3.2, WX4200D5 → Ver. 1.3.5, GX621A1 → Ver. 3.2.2, SH621A1 → Ver. 3.2.2, and 19000T12BE → Ver. 1.1.0, as detailed in the NEC advisory at https://jpn.nec.com/security-info/secinfo/nv26-002_en.html. As a compensating control for devices awaiting firmware updates, restrict management interface access to a dedicated, isolated management VLAN or use a host-based firewall to limit which client IPs can reach the web UI (trade-off: adds operational friction). Avoid accessing the router management interface from a device that is also used for general web browsing, particularly on untrusted or shared networks, to reduce the user-interaction prerequisite being met.