CVE-2026-4620 is an OS command injection flaw in NEC Platforms Aterm routers, specifically the WX1500HP and WX3600HP and their firmware. It scores CVSS 9.8 (critical) because it can be reached over the network with no login. NEC publishes the fixed firmware in notice nv26-001, so check it and update.
What's affected
The NVD record lists two NEC Aterm models and their firmware: the WX1500HP and the WX3600HP. The description says an attacker can execute arbitrary OS commands via the network.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms, the attacker needs network reach, no account and no user action, and the impact on confidentiality, integrity and availability is high.
The NEC notice is the only reference in the record. I could not fetch it (the site returned an access denied error), so I am not stating firmware version numbers here. The advisory should be checked directly for the affected and fixed firmware builds.
How to check if you're exposed
- Confirm whether any WX1500HP or WX3600HP units are in use. Look in the router's admin page, the label on the device and your asset list.
- Note the firmware version shown in the admin page.
- Open NEC security notice nv26-001 and compare your version with the fixed firmware it lists.
- Check whether the router's admin interface can be reached from the internet or from untrusted network segments. Reachability changes how urgent this is.
What to do now
- Update affected routers to the firmware named in NEC's notice.
- Until you can update, make sure the management interface is not exposed to the internet.
- Restrict who on the local network can reach the admin interface.
- If a unit cannot be updated, plan to replace it. A router with a known network command injection should not sit at the edge of a network.
- Record firmware versions in your inventory so later notices are easy to match.
Why it matters
The weakness class is CWE-78, improper neutralization of special elements used in an OS command. When a device builds a shell command from input it received and does not sanitize that input, the sender can influence what the device runs. On a router, that can mean control of the device that carries all of your traffic.
The record's KEV flag is false, and I found no source saying this is exploited. A critical, unauthenticated, network reachable bug on a router is still worth treating promptly. A companion record, CVE-2026-4622, covers the same weakness in other Aterm models from the same notice.
Quick check
Is CVE-2026-4620 exploited in the wild?
The record's KEV flag is false and no advisory text I could read says it is exploited. Patch on a short timeline anyway, because the flaw needs no login.
Sources
Last reviewed: 19 October 2026.
