CVE-2026-16876

NEC's UNIVERGE IX-R and IX-V series routers contain a missing-authentication flaw (CWE-306) in their WebGUI that allows a user to bypass login entirely. An attacker triggers it by tampering with WebGUI messages and sending the crafted requests to the device's web interface over the network. Successful exploitation grants the ability to execute arbitrary CLI commands on the router, giving full control over device configuration and traffic (CVSS 4.0 rates the impact as critical, 9.3). Any organization running an IX-R or IX-V router whose WebGUI is reachable from the internet is exposed; units whose web interface is restricted to internal management networks face substantially lower risk. There is no known exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA's KEV catalog, with EPSS estimating only a 0.3% chance of exploitation in the next 30 days.

What to do: Check the NEC PSIRT advisory for CVE-2026-16876 to identify affected firmware revisions and apply the fixed firmware when released. Until then, restrict access to the router's WebGUI to trusted management networks or via ACLs/firewall rules, and confirm no internet-facing WebGUI listeners remain on IX-R/IX-V units. Review device logs for unexpected configuration changes or unrecognized CLI commands that may indicate tampering.