CVE-2026-77853

CVE-2026-77853 is an OS command injection flaw (CWE-78) in the FF-RFI079I4 and FF-RFI078I4 radio units, devices whose M-Plane management interface uses NETCONF (the O-RAN-style management plane). A user who can authenticate to the product's M-Plane can submit input containing unneutralized special elements that gets passed to OS commands, allowing arbitrary command execution on the device. Successful exploitation gives the attacker full control of the unit's operating system, with high impact on its confidentiality, integrity, and availability (CVSS 4.0: 8.7), though only the device itself is affected, not other systems. Operators that deploy these specific models and expose NETCONF (typically TCP 830) to users beyond trusted management staff are affected. There is no public proof of concept, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.

What to do: Check the vendor and JPCERT/CC advisories for these model numbers and apply the patched firmware as soon as it is available. Until then, restrict NETCONF (TCP 830) M-Plane access to a dedicated management network with an IP allowlist, rotate M-Plane credentials, and disable any unnecessary management accounts. Review device and NETCONF server logs for unexpected or malformed commands indicating injection attempts.