CVE-2026-6059

State: Published
Severity: 4.8 Medium
Published: May 25, 2026
Updated: May 26, 2026
Reserved: Apr 10, 2026

Description

A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	NEC

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Aterm WX1800HPNEC Platforms, Ltd.	Before Ver. 3.2.2Affected
Aterm WX5400HPNEC Platforms, Ltd.	Before Ver. 2.1.0Affected
Aterm WX7800T8NEC Platforms, Ltd.	Before Ver. 1.5.1Affected
Aterm WX11000T12NEC Platforms, Ltd.	Before Ver. 1.4.0Affected
Aterm WX3000HP2NEC Platforms, Ltd.	Before Ver. 1.3.2Affected
Aterm WX4200D5NEC Platforms, Ltd.	Before Ver. 1.3.5Affected
Aterm GX621A1NEC Platforms, Ltd.	Before Ver. 3.2.2Affected
Aterm SH621A1NEC Platforms, Ltd.	Before Ver. 3.2.2Affected
Aterm 19000T12BENEC Platforms, Ltd.	Before Ver. 1.1.0Affected

References

https://jpn.nec.com/security-info/secinfo/nv26-002_en.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.