Medium severity · published May 25, 2026
CVE-2026-6059
A cross-site scripting vulnerability exists in Aterm
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A1
Aterm 19000T12BE · NEC Platforms, Ltd.
Before Ver. 1.1.0 · source: vendor
AG
Aterm GX621A1 · NEC Platforms, Ltd.
Before Ver. 3.2.2 · source: vendor
AS
Aterm SH621A1 · NEC Platforms, Ltd.
Before Ver. 3.2.2 · source: vendor
AW
Aterm WX11000T12 · NEC Platforms, Ltd.
Before Ver. 1.4.0 · source: vendor
AW
Aterm WX1800HP · NEC Platforms, Ltd.
Before Ver. 3.2.2 · source: vendor
AW
Aterm WX3000HP2 · NEC Platforms, Ltd.
Before Ver. 1.3.2 · source: vendor
AW
Aterm WX4200D5 · NEC Platforms, Ltd.
Before Ver. 1.3.5 · source: vendor
AW
Aterm WX5400HP · NEC Platforms, Ltd.
Before Ver. 2.1.0 · source: vendor
AW
Aterm WX7800T8 · NEC Platforms, Ltd.
Before Ver. 1.5.1 · source: vendor