{"id":"CVE-2026-4622","state":"PUBLISHED","title":"OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.","description":"OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.","publishedAt":"2026-03-27T11:53:12.245Z","updatedAt":"2026-04-10T04:14:44.673Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"NEC"},"assigner":"NEC","products":["NEC Platforms, Ltd. Aterm WG2600HS","NEC Platforms, Ltd. Aterm WF1200CR","NEC Platforms, Ltd. Aterm WG1200CR","NEC Platforms, Ltd. Aterm WG2600HP4","NEC Platforms, Ltd. Aterm WG2600HM4","NEC Platforms, Ltd. Aterm WG2600HS2","NEC Platforms, Ltd. Aterm WX3000HP","NEC Platforms, Ltd. Aterm WX3000HP2","NEC Platforms, Ltd. Aterm GB1200PE"],"affected":[{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HS","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.7.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WF1200CR","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.6.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG1200CR","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.5.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HP4","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.4.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HM4","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.4.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HS2","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WX3000HP","defaultStatus":"unknown","versions":[{"version":"Before Ver. 2.5.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WX3000HP2","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm GB1200PE","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.1","status":"affected"}]}],"references":["https://jpn.nec.com/security-info/secinfo/nv26-001_en.html"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4622.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4622","state":"PUBLISHED","datePublished":"2026-03-27T11:53:12.245Z","dateUpdated":"2026-04-10T04:14:44.673Z","assignerShortName":"NEC","assignerOrgId":"f2760a35-e0d8-4637-ac4c-cc1a2de3e282","dateReserved":"2026-03-23T06:04:49.866Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network."}],"affected":[{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HS","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.7.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WF1200CR","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.6.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG1200CR","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.5.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HP4","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.4.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HM4","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.4.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WG2600HS2","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WX3000HP","defaultStatus":"unknown","versions":[{"version":"Before Ver. 2.5.0","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm WX3000HP2","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.2","status":"affected"}]},{"vendor":"NEC Platforms, Ltd.","product":"Aterm GB1200PE","defaultStatus":"unknown","versions":[{"version":"Before Ver. 1.3.1","status":"affected"}]}],"references":[{"url":"https://jpn.nec.com/security-info/secinfo/nv26-001_en.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","lang":"en","description":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","type":"CWE"}]}],"providerMetadata":{"shortName":"NEC","orgId":"f2760a35-e0d8-4637-ac4c-cc1a2de3e282","dateUpdated":"2026-04-10T04:14:44.673Z"},"credits":[{"lang":"en","value":"Chuya Hayakawa of Zero Zero One Co., Ltd.","user":"00000000-0000-4000-9000-000000000000","type":"reporter"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-27T12:50:35.148912Z","id":"CVE-2026-4622","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-27T12:53:16.253Z"}}]}}}