Authentication Bypass in NEC UNIVERGE IX-R/IX-V WebGUI

Executive Summary

CVE-2026-16876 is an authentication bypass vulnerability in the WebGUI of NEC's UNIVERGE IX-R/IX-V series network devices. It allows an attacker to bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device over the internet.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual WebGUI message tampering or CLI command execution attempts. Check device logs for unauthorized access or command execution. Inspect network devices running UNIVERGE IX-R/IX-V series firmware versions between Ver1.1 to Ver1.3, Ver1.4.21 to Ver1.4.28, or Ver1.5.23.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized access to network devices, enabling attackers to execute malicious commands, disrupt network operations, or gain control over the device. It poses a significant risk to network security and stability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and execution of commands on network devices, potentially compromising data confidentiality and integrity. For GDPR, it may result in unauthorized data access or processing, violating principles of lawfulness and security. For HIPAA, it could allow unauthorized access to protected health information, violating safeguards for confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected devices to the latest firmware version or disable the WebGUI interface to prevent exploitation. Ensure network segmentation to limit exposure of vulnerable devices.

Useful 0 Not Useful 0