This vulnerability (CVE-2026-8652) is classified as CWE-78, indicating improper neutralization of special elements used in an OS command, commonly known as OS Command Injection. It affects the Aterm MR51FN product from NEC Platforms, Ltd. Versions prior to 3.4.0 are vulnerable. An attacker who has administrator privileges on the device’s web console can execute arbitrary OS commands on the device via the adjacent network. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, and high privileges, with no user interaction required. The vulnerability is rated high severity with a CVSS score of 8.5. No patch or official remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows an attacker with administrator access to the device’s web console to execute arbitrary operating system commands. This can lead to full control over the affected device, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability requires the attacker to already have administrator privileges, limiting the initial attack surface. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to the device’s web console to trusted personnel only. Monitor for unauthorized access attempts and consider network segmentation to limit adjacent network access to the device. Follow up with NEC Platforms, Ltd. for updates on patches or official mitigations.