This vulnerability (CVE-2026-4622) affects NEC Platforms, Ltd. Aterm WG2600HS devices prior to version 1.7.2. It is classified as CWE-78, indicating improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. An attacker with high privileges and authenticated user interaction can exploit this flaw to execute arbitrary operating system commands remotely via the network. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no attack vector privilege requirement, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges and user interaction to execute arbitrary OS commands on the affected device remotely. This can lead to compromise of device integrity, confidentiality, and availability. However, exploitation requires authenticated access and user interaction, which limits the attack surface. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are before 1.7.2, upgrading to version 1.7.2 or later (if available) is recommended once confirmed by the vendor. Until an official fix is confirmed, restrict access to the device management interface to trusted users only and monitor for suspicious activity requiring user interaction.