by Kastro
Paper/Archive/CVE-2026-16876

CVE-2026-16876

NEC Corporation UNIVERGE IX-R/IX-V — An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V.

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 47.7.477 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet.

Affected

ProductAffectedFixed inSource
UNIVERGE IX-R/IX-VAll versions from Ver1.1 through Ver1.3, All versions from Ver1.4.21 through Ver1.4.28 and Ver1.5.23–CNA

Scores by source

NEC (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refjpn.nec.com/security-info/secinfo/nv26-005_en.html