Summaryinfo

A vulnerability categorized as critical has been discovered in NEC Platforms Aterm W1200EX, Aterm WG1200HP2, Aterm WG1900HP, Aterm WG1200HS2, Aterm WG1800HP3, Aterm WG1200HP3, Aterm WG1900HP2, Aterm WG1200HS3, Aterm WG1800HP4, Aterm WG1200HP4, Aterm WG1200HS4, Aterm WX1500HP, Aterm WG2600HS, Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HP4, Aterm WG2600HM4, Aterm WG2600HS2, Aterm WX3000HP, Aterm WX3000HP2 and Aterm WX3600HP. This affects an unknown part. Executing a manipulation can lead to backdoor. This vulnerability is tracked as CVE-2026-4621. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in NEC Platforms Aterm W1200EX, Aterm WG1200HP2, Aterm WG1900HP, Aterm WG1200HS2, Aterm WG1800HP3, Aterm WG1200HP3, Aterm WG1900HP2, Aterm WG1200HS3, Aterm WG1800HP4, Aterm WG1200HP4, Aterm WG1200HS4, Aterm WX1500HP, Aterm WG2600HS, Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HP4, Aterm WG2600HM4, Aterm WG2600HS2, Aterm WX3000HP, Aterm WX3000HP2 and Aterm WX3600HP. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a backdoor vulnerability. The CWE definition for the vulnerability is CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

The advisory is shared for download at jpn.nec.com. This vulnerability was named CVE-2026-4621 since 03/23/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/27/2026). The MITRE ATT&CK project declares the attack technique as T1588.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-16589). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• NEC Platforms

Name

• Aterm W1200EX
• Aterm WF1200CR
• Aterm WG1200CR
• Aterm WG1200HP2
• Aterm WG1200HP3
• Aterm WG1200HP4
• Aterm WG1200HS2
• Aterm WG1200HS3
• Aterm WG1200HS4
• Aterm WG1800HP3
• Aterm WG1800HP4
• Aterm WG1900HP
• Aterm WG1900HP2
• Aterm WG2600HM4
• Aterm WG2600HP4
• Aterm WG2600HS
• Aterm WG2600HS2
• Aterm WX1500HP
• Aterm WX3000HP
• Aterm WX3000HP2
• Aterm WX3600HP

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion