Remote Code Execution in Generic OEM UZ801_v2.1 4G LTE Router

Executive Summary

CVE-2026-52199 is an Incorrect Access Control vulnerability in the Generic OEM UZ801_v2.1 4G LTE Router with Firmware V3.4.3. It allows a remote attacker on the same local network to exploit an exposed, unauthenticated Android Debug Bridge (ADB) daemon running on TCP port 7628. This flaw enables bypassing authentication and gaining root-level access to execute arbitrary code.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if TCP port 7628 is open on your router. Use commands like 'nmap -p 7628 192.168.100.1' or 'nc -zv 192.168.100.1 7628'. If the port is open, the ADB daemon may be exposed and vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe impacts such as full system compromise, remote code execution, privilege escalation, information disclosure, and potential denial of service. An attacker can gain complete control over the router, access sensitive data, and disrupt network operations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to severe compliance violations under standards like GDPR and HIPAA due to potential unauthorized access, data disclosure, and system compromise. Exploitation may result in unauthorized data exposure, which violates GDPR's data protection requirements, and unauthorized access to sensitive systems, which conflicts with HIPAA's security controls for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the ADB daemon on the router if possible. Block TCP port 7628 in the router's firewall settings. Ensure the device is not accessible from untrusted networks. Update the firmware if a patch is available.

Useful 0 Not Useful 0