NEC Platforms, Ltd. vulnerabilities

Products

• Aterm WX3600HP 4
• Aterm GB1200PE 3
• Aterm WF1200CR 3
• Aterm WG1200CR 3
• Aterm WG2600HM4 3
• Aterm WG2600HP4 3
• Aterm WG2600HS 3
• Aterm WG2600HS2 3
• Aterm WX1500HP 3
• Aterm WX3000HP 3
• Aterm WX3000HP2 3
• Aterm GX1200HP 2
• Aterm GX1200HS4 2
• Aterm W1200EX(-MS) 2
• Aterm WG1200DM4 2
• Aterm WG1200HP2 2
• Aterm WG1200HP3 2
• Aterm WG1200HP4 2
• Aterm WG1200HS2 2
• Aterm WG1200HS3 2
• Aterm WG1200HS4 2
• Aterm WG1800HP3 2
• Aterm WG1800HP4 2
• Aterm WG1900HP 2
• Aterm WG1900HP2 2
• Calsos CSDX and CSDJ series products 2
• ITK-12D-1(BK)TEL 2
• ITK-12D-1P(BK)TEL 2
• ITK-12DG-1P(BK)TEL 2
• ITK-32LCG-1P(BK)TEL 2

Latest NEC Platforms, Ltd. CVEs

Newest publication first

1. CVE-2026-8652 An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to execute arbitrary OS commands via adjace...

   Published 2026-05-25

   High·CVSS 8.5 EPSS 0.72%

   An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to execute arbitrary OS commands via adjacent network.

2. CVE-2026-6059 A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

   Published 2026-05-25

   Medium·CVSS 4.8 EPSS 0.18%

   A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

3. CVE-2026-4620 OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

   Published 2026-03-27

   High·CVSS 7.1 EPSS 1.0%

   OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

4. CVE-2026-4622 OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

   Published 2026-03-27

   High·CVSS 7.1 EPSS 0.88%

   OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS commands via network.

5. CVE-2026-4621 Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

   Published 2026-03-27

   Medium·CVSS 6.3 EPSS 0.16%

   Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

6. CVE-2026-4619 Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

   Published 2026-03-27

   Medium·CVSS 6.0 EPSS 0.33%

   Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

7. CVE-2026-4309 Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via network.

   Published 2026-03-27

   Medium·CVSS 6.3 EPSS 0.14%

   Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device information and change the settings via network.

8. CVE-2024-3016 NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticat...

   Published 2024-05-09

   Critical·CVSS 9.1 EPSS 0.68%

   NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.

9. CVE-2023-3741 An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.

   Published 2023-11-30

   Critical·CVSS 9.8 EPSS 1.5%

   An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device.

10. CVE-2022-25621 UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE....

    Published 2022-03-11

    Critical·CVSS 9.8 EPSS 1.4%

    UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE W...

11. CVE-2021-20677 UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated....

    Published 2021-03-26

    Low·CVSS 3.1 EPSS 0.95%

    UNIVERGE Aspire series PBX (UNIVERGE Aspire WX from 1.00 to 3.51, UNIVERGE Aspire UX from 1.00 to 9.70, UNIVERGE SV9100 from 1.00 to 10.70, and SL2100 from 1.00 to 3.00) allows a remote authenticated attacker to cause system down and a denial of service (DoS) condition by sending...

12. CVE-2021-20653 Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain....

    Published 2021-02-17

    Medium·CVSS 5.3 EPSS 1.2%

    Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors.

13. CVE-2018-0614 Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.3721041...

    Published 2018-07-26

    Medium·CVSS 6.1 EPSS 0.79%

    Cross-site scripting vulnerability in NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D...

14. CVE-2018-0613 NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and ear...

    Published 2018-07-26

    High·CVSS 8.8 EPSS 1.1%

    NEC Platforms Calsos CSDX and CSDJ series products (CSDX 1.37210411 and earlier, CSDX(P) 4.37210411 and earlier, CSDX(D) 3.37210411 and earlier, CSDX(S) 2.37210411 and earlier, CSDJ-B 01.03.00 and earlier, CSDJ-H 01.03.00 and earlier, CSDJ-D 01.03.00 and earlier, CSDJ-A 03.00.00)...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.