An OS Command Injection flaw permits an attacker to run arbitrary operating‑system commands on NEC’s Aterm series devices through a network interface. The vulnerability is a classic command injection (CWE‑78) that can be leveraged to compromise confidentiality, integrity, and availability of the affected devices, potentially giving attackers full administrative control over the network equipment.

The security issue affects NEC Platforms, Ltd. Aterm networking devices, including the WF1200CR, WG1200CR, WG2600HM4, WG2600HP4, WG2600HS, WG2600HS2, WX3000HP, and WX3000HP2 models. No specific firmware or hardware version details are listed in the advisory, so any device after the initial release may be at risk until a vendor update is applied.

The CVSS score of 7.1 underscores a high severity, and the exploit is network‑based, meaning an attacker only needs connectivity to the device’s management or configuration interface. While the EPSS score is not available and the vulnerability is not in CISA's KEV catalog, the potential impact warrants prompt remediation. The advisory does not detail an exploit in the wild, but the known vector and high score suggest the issue should be treated as credible.