Which versions of NEC Aterm are affected by CVE-2026-8652?

NEC Platforms Aterm MR51FN and CM51FD routers contain a command-execution vulnerability allowing compromised administrator accounts to seize complete control of affected network devices.

How to fix or mitigate CVE-2026-8652?

Within 24 hours: Inventory all Aterm MR51FN (version before 3.4.0) and CM51FD (version before 1.2.0) routers; audit administrator access logs for unauthorized activities. Within 7 days: Restrict administrative access to essential personnel only; disable remote management if not required; enforce unique strong credentials; implement network segmentation isolating router management to a protected administrative VLAN. Within 30 days: Monitor NEC Platforms website for patch availability (MR51FN Ver. 3.4.0+ and CM51FD Ver. 1.2.0+); develop upgrade plan for immediate deployment when patches release; evaluate alternative router vendors as contingency if patch timeline remains unclear.

NEC Aterm CVE-2026-8652

Q: What is the CVSS score of CVE-2026-8652?

CVE-2026-8652 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-31620 HIGH

OS Command Injection (CWE-78)

2026-05-25 NEC

GHSA-2ww7-hqm8-2qhf

Command Injection Aterm Mr51Fn Aterm Cm51Fd Nec Platforms Ltd

8.5

CVSS 4.0 · Vendor: NEC

Severity by source

Vendor (NEC) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent network reach (AV:A) and mandatory administrator access to the web console (PR:H) with no user interaction; command injection yields full C/I/A compromise of the device (S:U).

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NEC).

CVSS VectorVendor: NEC

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:22 vuln.today

CVE Published

May 25, 2026 - 02:23 nvd

UNKNOWN (no severity yet)

CVE Published

May 25, 2026 - 02:23 cve.org

HIGH 8.5

DescriptionCVE.org

An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to execute arbitrary OS commands via adjacent network.

AnalysisAI

Authenticated OS command execution in NEC Platforms Aterm MR51FN (before Ver. 3.4.0) and CM51FD (before Ver. 1.2.0) routers lets an attacker who already holds administrator credentials to the web console inject arbitrary operating-system commands over an adjacent network. Impact is total (confidentiality, integrity and availability all High per CVSS 4.0), effectively giving full control of the affected device, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.34%, 57th percentile). Exploitation is gated behind administrator access and adjacent (not internet-wide) reach, so this is a privilege-escalation-to-device-takeover primitive rather than a remote unauthenticated compromise.

Technical ContextAI

Aterm is a line of consumer/SOHO networking equipment (routers, ONUs and mobile/LTE gateways) manufactured by NEC Platforms, Ltd.; the specific affected models are the MR51FN (a mobile/LTE router) and the CM51FD. The flaw is classed as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning a value handled by the device's web management console is passed into a shell or system() call without adequate sanitization, allowing shell metacharacters to break out and run attacker-chosen commands with the privileges of the web console backend (typically root on embedded Linux firmware). The CPE strings cpe:2.3:a:nec_platforms,_ltd.:aterm_mr51fn and cpe:2.3:a:nec_platforms,_ltd.:aterm_cm51fd confirm the two impacted product lines. Command injection in the administrative web interface is a classic embedded-device weakness where authenticated configuration fields (network settings, diagnostics/ping utilities, etc.) reach the underlying OS.

RemediationAI

Apply the vendor firmware updates: upgrade Aterm CM51FD to Ver. 1.2.0 or later and Aterm MR51FN to Ver. 3.4.0 or later, as directed by NEC advisory NV26-003 (https://jpn.nec.com/security-info/secinfo/nv26-003_en.html). Because exploitation requires administrator access to the web console over an adjacent network, effective compensating controls until patching include: change the default/administrator web-console password to a strong unique value and ensure it is not shared or reused; restrict management-plane access so the web console is only reachable from a trusted management segment or wired LAN rather than exposed to guest/adjacent Wi-Fi (trade-off: legitimate remote administration from those segments is blocked); disable remote/WAN-side management if enabled; and place the device management interface on a segmented VLAN to shrink the adjacent-network attack surface. These controls reduce who can reach the admin console but do not remove the underlying injection flaw, so firmware upgrade remains the definitive fix.