This vulnerability involves improper neutralization of input during web page generation (CWE-79) in the Aterm WX1800HP router by NEC Platforms, Ltd. An attacker on an adjacent network can exploit this flaw to execute arbitrary scripts in the context of the web management interface user’s browser. The CVSS 4.0 base score is 4.8, reflecting a medium severity with attack vector limited to adjacent network, low attack complexity, no privileges required, but user interaction needed. The vulnerability affects firmware versions before 3.2.2. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the browser of a user managing the device, potentially leading to session hijacking or other web-based attacks within the management interface context. However, the attack requires user interaction and access from an adjacent network, limiting the scope and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the web management interface to trusted networks and users only, and avoid interacting with suspicious content while managing the device.