CVE-2026-2118
Published: 08 February 2026
Summary
CVE-2026-2118 is a high-severity Injection (CWE-74) vulnerability in Utt 810 Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-2118 is a command injection vulnerability affecting UTT HiPER 810 version 1.7.4-141218. The issue resides in the sub_4407D4 function within the /goform/formReleaseConnect file of the rehttpd component. It arises from improper handling of the Isp_Name argument, allowing injected commands, and was published on 2026-02-08. The vulnerability is classified under CWE-74 and CWE-77.
The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). It can be exploited remotely by authenticated attackers possessing high privileges, with low attack complexity and no user interaction required. Successful exploitation enables command injection, resulting in high impacts to confidentiality, integrity, and availability.
Advisories referenced in VulDB (ctiid.344693, id.344693, submit.746802) and a GitHub repository (cha0yang1/UTT810CVE) detail the vulnerability, including a proof-of-concept exploit and readme. The exploit has been publicly disclosed and may be utilized. No specific patch or mitigation details are provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5827
Vulnerability details
A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be…
more
launched remotely. The exploit has been publicly disclosed and may be utilized.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web form of network device directly enables remote exploitation of public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of the Isp_Name input argument to block command injection in formReleaseConnect.
Limits privileges of the high-privilege account required for exploitation, reducing the ability to execute injected commands.
Restricts the web server's ability to invoke arbitrary system commands from the rehttpd component handling formReleaseConnect.