Path Traversal in NEC Aterm Routers Allows Arbitrary File Overwrite

Publication date: 2026-03-27

Last updated on: 2026-04-20

Assigner: NEC Corporation

Description

Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-27

Last Modified

2026-04-20

Generated

2026-07-06

AI Q&A

2026-03-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-4619

EUVD

EUVD-2026-16586

Affected Vendors & Products

Vendor	Product	Version / Range
nec	aterm_wx3600hp_firmware	to 1.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a Path Traversal issue found in NEC Platforms, Ltd. Aterm Series devices. It allows an attacker to write over any file on the system via the network.

Impact Analysis

An attacker exploiting this vulnerability can overwrite arbitrary files on the affected device remotely. This could lead to unauthorized modification or destruction of critical system files, potentially causing system malfunction, data loss, or enabling further attacks.

Hi! I’m here to help you understand CVE-2026-4619. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70