CVE-2026-8652

HighCVSS 8.5/10Last modified Jul 23, 2026

Description

An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the product’s web console, they may be able to execute arbitrary OS commands via adjacent network.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
NEC Platforms, Ltd.Aterm MR51FNBefore Ver. 3.4.0
NEC Platforms, Ltd.Aterm CM51FDBefore Ver. 1.2.0

References

Timeline

Published
May 25, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-865207.5Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subsCVE-2026-865226.3Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge applicatCVE-2026-86536.5The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, CVE-2026-865307.2BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a CVE-2026-86531The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporCVE-2026-86532The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticateCVE-2026-865339.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to reCVE-2026-865358.7Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollutCVE-2026-865366.3Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. CVE-2026-865378.7Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache TCVE-2026-865387.5knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticatedCVE-2026-865397.2knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo
CVE-2026-8652: High severity, CVSS 8.5 | Vulnix