From our other sites
The story
On October 26, NEC’s Aterm information site announced that Aterm products are not affected by the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed earlier that month. Some models display “index.php” in the settings-screen URL, but according to NEC this is simply because the filename happens to end in “.php” — the devices don’t actually run PHP. On 5ch, alongside relieved comments like “I totally missed that blind spot,” the discussion spread to questions like why the “.php” label remains if it’s not even used, and whether Aterm is an NEC product or a Lenovo one.
On October 26, the information site for NEC’s “Aterm” Wi-Fi and mobile routers announced it had confirmed that Aterm products and services are not affected by the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) disclosed on the 22nd.
On some models in the Aterm series, the URL for the settings screen (“Quick Setup Web”) may display “/index.php”. NEC says this is simply because the URL ends in the string “.php” — the devices don’t actually use PHP, so they’re unaffected by this vulnerability.
Any new information will be published on the same page.
Source: itmedia.co.jp / Original article here
What people said
but hey, relieved lol
Looks like networking gear like Aterm stayed entirely under NEC.
The PC business is a joint venture between the two, and Lenovo holds the largest, controlling stake there.
Even back in NEC's own era, some models were OEM'd by a Chinese manufacturer, not Lenovo.
aren't they just saying that to avoid one?
index.php > index.html > index.html.var > index.htm > index.shtml > index.cgi
If you're satisfied with an explanation like that, you might be an easy mark for scammers.
That's not really an explanation.
They need to explain why it ends in .php in the first place —
it's not just that it happens to end that way,
there's a reason it got that way:
it's a leftover from back when they actually used PHP, and now it's just a fossil name they forgot to clean up. The honest answer is "sorry, that's our screwup for leaving it there."
— if Chinese manufacturers got a foothold there, NEC would get locked out of government-related business, even at the Aterm level.
The enterprise side is NEC itself, but Aterm and other consumer products come from a separate company, NEC Platforms.
Don't lump them together.
Am I gonna get attacked?
Its IP address
is 192.198.1.1.
That gives me a little chill.
Isn't it the other way around?
You set up httpd so index.php actually gets run through PHP.
NEC really makes solid routers.
Chinese-made ones seem like they'd have a backdoor baked in.
Now it's just a generic Arm + Linux setup, so there's not much difference from other makers (though that's also why you can now install OpenWrt on them).
it's probably not even patched for that.
If it's only ever accessed for router admin purposes, it never goes out to the internet, so it should be fine.
there are a lot of those out there.
perhaps protected (a tongue-in-cheek backronym joke for "PHP")
If someone's already gotten into your LAN through some other route, then whether PHP's involved is beside the point at that stage.
Background and Key Points of the Discussion
The CVE-2026-109618 and -109619 vulnerabilities at the center of this story affect devices that actually run PHP on a web server — the mere presence of a “.php” filename isn’t itself a red flag. NEC explains that the “index.php” that still shows up in Aterm’s admin screen URL is simply a holdover from an older implementation and the general naming convention for index files; the actual processing is handled by something other than a PHP interpreter. The thread’s biggest sticking point was “why does the label stick around if it’s not even in use” — but that kind of leftover naming is common across many web-based products and doesn’t imply a security flaw. Another point that got muddled was the corporate structure: NEC itself, the NEC–Lenovo joint venture that runs the PC business, and NEC Platforms — the separate company that handles consumer gear like Aterm — are all distinct entities, and the thread never quite managed to untangle them.
*This article is an excerpt and summary of the 5ch (Business News+) thread “[IT] NEC’s Router “Aterm” Unaffected by PHP Vulnerability — The “.php” in the Settings URL Is Unrelated.”
Leave a Reply