Remote Code Execution in Generic OEM UZ801_v2.1 4G LTE Router

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: MITRE

Description

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-52200

Affected Vendors & Products

Vendor	Product	Version / Range
generic_oem	uz801_v2.1	4.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Generic OEM UZ801_v2.1 4G LTE Router V3.4.3. It allows a remote attacker to execute arbitrary code by exploiting the /ajax web management API endpoint in the MifiService.apk component.

Impact Analysis

An attacker exploiting this vulnerability could remotely execute arbitrary code on the affected router, potentially gaining unauthorized control over the device. This could lead to disruption of network services, interception or manipulation of data, or using the device as a foothold for further attacks.

Hi! I’m here to help you understand CVE-2026-52200. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70