CVE-2026-2188

7.3 highEPSS 7.2%

A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

Severity

CVSS 4.0

7.3 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.2% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-77
Published: 2026-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

utt:521g_firmware

References

https://github.com/cha0yang1/UTT521G/blob/main/RCE2.md
https://vuldb.com/?ctiid.344891
https://vuldb.com/?id.344891
https://vuldb.com/?submit.749733

Check your stack JSON