CVE-2026-4619 is a critical (CVSS 9.8) path traversal in the NEC Aterm WX3600HP router that lets a network attacker overwrite any file. I could not read NEC's advisory when preparing this guide, so check it for the fixed firmware and update.
What's affected
The NVD record names the NEC Aterm WX3600HP and its firmware, and describes the Aterm Series as affected. It gives no version list. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, so no login and no user action are needed.
NEC publishes the details in notice nv26-001 on its Japanese security site. The page returned an access error when I fetched it, so I will not state affected or fixed firmware versions here. The advisory should be checked directly.
How to check if you're exposed
- Identify any NEC Aterm devices on your network, including at branch offices and homes of remote staff.
- Read your router's firmware version in its admin page.
- Compare it with the list in NEC's notice at the link under Sources.
- Note whether the management interface can be reached from the internet. If it can, treat the device as urgent.
Home and small office routers are easy to forget in an asset list. Add each one to your inventory with its model and firmware so that a notice like this one is quick to act on, and keep a note of who owns the device.
What to do now
- Open NEC notice nv26-001 and note the fixed firmware.
- Update each affected device and confirm the new version.
- Turn off remote administration unless you need it.
- Replace devices that no longer receive updates.
Why it matters
The class is CWE-22, path traversal. A request that includes crafted path elements can reach files outside the folder the device meant to expose, and here the record says that includes writing over any file. On a router, overwriting system files can change its behaviour or break it. The KEV flag is false, and the record does not say it is exploited. Because no credentials are needed, do not leave it for a quiet week.
Quick check
Is this exploited in the wild?
The record's KEV flag is false, and I found no advisory text saying so.
Sources
Last reviewed: 19 October 2026.
