An OS Command Injection flaw allows a malicious actor who has gained administrator access to the Aterm web console to execute arbitrary operating system commands. The vulnerability is triggered via the web interface and can be exercised from any adjacent network location, providing the attacker control over the underlying operating system.

The flaw affects NEC Platforms, Ltd. Aterm CM51FD and Aterm MR51FN devices. Any system running either product where the web console is exposed to a network and can be accessed with administrative credentials is vulnerable.

With a CVSS score of 8.5, the vulnerability is high severity. No EPSS score is available and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the web console requiring prior administrative authentication; once authenticated, an attacker can trigger the command injection.