This vulnerability (CVE-2026-6059) involves improper neutralization of input during web page generation (CWE-79) in the Aterm WX1800HP device by NEC Platforms, Ltd. An attacker on an adjacent network can cause arbitrary scripts to execute in the web browser of a user accessing the device's web management interface. The CVSS 4.0 base score is 4.8 (medium), reflecting that the attack vector is adjacent network, with low complexity, no privileges required, but requires user interaction. The vulnerability affects firmware versions before 3.2.2. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected device's web management interface, potentially allowing an attacker to perform actions on behalf of the user or steal sensitive information accessible through the interface. However, exploitation requires access to an adjacent network and user interaction, limiting the scope and ease of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the web management interface to trusted networks only and avoid accessing the interface from untrusted or adjacent networks. Monitor vendor communications for updates regarding patches or mitigations.