CVE-2026-2182
Command Injection in UTT 进取 521G doSystem Function
Publication date: 2026-02-08
Last updated on: 2026-02-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 521g_firmware | 3.1.1-190816 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2182 is a critical command injection vulnerability found in the UTT 进取 521G device, version 3.1.1-190816. The flaw exists in the function doSystem within the file /goform/setSysAdm, specifically due to improper handling of the argument passwd1.
Because the passwd1 parameter is not properly sanitized, an attacker can inject arbitrary commands that get executed by the system. This allows remote attackers, who have an enhanced level of authentication, to execute commands with root privileges on the device.
The vulnerability is classified under CWE-77, meaning it involves constructing commands using externally influenced input without neutralizing special characters, enabling modification of intended command execution.
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker to execute arbitrary system commands with root privileges on the affected device, leading to full system compromise.
This impacts the confidentiality, integrity, and availability of the system, as attackers can manipulate system functions, access sensitive data, disrupt services, or take control of the device remotely.
Since the exploit is publicly available and the attack can be launched remotely, the risk of exploitation is significant, especially if the device is exposed to untrusted networks.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the /goform/setSysAdm endpoint of the UTT 进取 521G device for command injection via the passwd1 parameter.'}, {'type': 'paragraph', 'content': 'A common approach is to send crafted HTTP requests to the vulnerable endpoint with payloads designed to execute commands, such as injecting shell commands through the passwd1 argument.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send a request like: curl -X POST http://<target-ip>/goform/setSysAdm -d "passwd1=;id;"'}, {'type': 'list_item', 'content': 'Observe the response or behavior of the device to check if the injected command (e.g., id) was executed.'}, {'type': 'paragraph', 'content': 'Since a public proof-of-concept exploit is available on GitHub, reviewing that resource can provide specific commands and payloads for detection.'}] [1, 2, 3]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'No known countermeasures or mitigations have been identified for this vulnerability.'}, {'type': 'paragraph', 'content': 'The recommended immediate step is to replace the affected UTT 进取 521G device or firmware version 3.1.1-190816 with an alternative product or updated firmware that is not vulnerable.'}, {'type': 'paragraph', 'content': "Additionally, restrict remote access to the device's management interface to trusted networks and users with strong authentication to reduce the risk of exploitation."}] [2]