CVE-2026-4622 is an OS command injection flaw in four NEC Platforms Aterm models: GB1200PE, WF1200CR, WG1200CR and WG2600HM4. It scores CVSS 9.8 (critical) and can be reached over the network without authentication. NEC lists the fixed firmware in notice nv26-001, so confirm your build there and update.
What's affected
The NVD record names these Aterm devices and their firmware: GB1200PE, WF1200CR, WG1200CR and WG2600HM4. The description says an attacker can execute arbitrary OS commands via the network.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means network reach is enough: no account, no user action, low complexity.
The record's only reference is NEC notice nv26-001. The site refused my request with an access denied error, so I cannot confirm firmware version numbers. Please check the advisory itself for the affected and fixed builds.
How to check if you're exposed
- Make a list of Aterm routers in your environment and match the model names above. Include devices at branch offices and homes of remote staff if you manage them.
- Read the firmware version from each device's admin page.
- Compare it with the fixed firmware in NEC notice nv26-001.
- Find out whether the admin interface is reachable from the internet or from guest and untrusted networks.
What to do now
- Install the fixed firmware from NEC on every affected unit.
- Turn off remote administration from the internet if it is on.
- Limit admin access to a trusted management network.
- Replace units that cannot be updated.
- Add model and firmware version to your asset list.
Why it matters
The class is CWE-78, OS command injection. The device passes data it did not fully clean into a system command, which lets the sender shape what runs on it. On a router, that position is powerful, since the device sits between your users and the network.
KEV status in the record is false, and I found no statement of exploitation. The sibling record CVE-2026-4620 covers the same weakness in the WX1500HP and WX3600HP.
Quick check
Do I need to be logged in to the router for this to matter?
The vector says privileges required are none and user interaction is none, so no login is needed according to the NVD record. The device must be reachable over the network, which is why limiting access to the admin interface helps.
Sources
Last reviewed: 19 October 2026.
