CVE-2026-2846
OS Command Injection in UTT HiPER 520 Web Interface
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 520_firmware | 1.7.7-160105 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2846 is a critical OS command injection vulnerability found in the UTT HiPER 520 router running firmware version 1.7.7-160105. It affects the Web Management Interface component, specifically the function sub_44D264 in the file /goform/formPdbUpConfig.
The vulnerability arises because the system does not properly sanitize the user-supplied input in the POST parameter named policyNames. This improper handling allows an attacker to inject and execute arbitrary operating system commands remotely by sending a crafted HTTP POST request containing shell metacharacters.
Exploitation requires authentication but can lead to unauthorized command execution with root privileges, resulting in full system compromise.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to full system compromise of the affected router.
- Attackers can execute arbitrary commands with root privileges.
- They may intercept network traffic.
- They can modify router configurations.
- Attackers may maintain persistent unauthorized access to the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for suspicious HTTP POST requests to the /goform/formPdbUpConfig endpoint containing the parameter policyNames with shell metacharacters such as semicolons (;). An example of such a malicious payload is policyNames=AnyValue;whoami, which attempts to inject and execute arbitrary OS commands.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts on your network or system, you can use network monitoring tools or intrusion detection systems to look for HTTP POST requests with suspicious policyNames parameters.'}, {'type': 'list_item', 'content': 'Use tools like tcpdump or Wireshark to capture HTTP POST traffic to /goform/formPdbUpConfig and filter for policyNames parameters containing shell metacharacters.'}, {'type': 'list_item', 'content': "Example tcpdump command to capture relevant HTTP POST requests: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i 'policyNames=.*;'"}, {'type': 'list_item', 'content': 'Check web server logs for POST requests to /goform/formPdbUpConfig with suspicious policyNames values containing shell metacharacters.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable web management interface to trusted and authenticated users only, as exploitation requires authentication.
Since no known mitigations or patches are reported, it is recommended to replace the affected UTT HiPER 520 device or firmware version 1.7.7-160105 with a secure alternative.
Additionally, monitor network traffic for exploitation attempts and consider implementing network-level controls such as firewall rules to block unauthorized access to the management interface.