This vulnerability (CVE-2026-8652) involves improper neutralization of special elements in OS commands (CWE-78) in the Aterm MR51FN device by NEC Platforms, Ltd. An attacker who has administrator privileges on the device's web console can exploit this flaw to execute arbitrary OS commands remotely over the adjacent network. The issue affects all versions prior to 3.4.0. The CVSS 4.0 vector indicates the attack requires adjacent network access and high privileges but no user interaction. No vendor patch or official remediation level has been published yet.

Successful exploitation allows an attacker with administrator access to the web console to execute arbitrary OS commands on the device, potentially compromising the device's integrity and confidentiality. This could lead to unauthorized control or disruption of the device's operation. However, exploitation requires prior administrator access, limiting the attack surface. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted personnel only and limit network access to the device's web console to trusted adjacent networks. Monitor for any unusual activity indicating potential exploitation attempts.