Cyber Resilience

CVE-2026-2182

HighPublic PoCRCE

Published: 08 February 2026

Published
08 February 2026
Modified
10 February 2026
KEV Added
Patch
CVSS Score v4 7.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0053 67.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2182 is a high-severity Injection (CWE-74) vulnerability in Utt 521G Firmware. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-2182 is a command injection vulnerability affecting the UTT 进取 521G router running firmware version 3.1.1-190816. The flaw exists in the doSystem function of the /goform/setSysAdm component, where the passwd1 argument can be manipulated to inject and execute arbitrary commands. Published on 2026-02-08, it is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation over the network by authenticated users possessing high privileges. Attackers require administrative access but face low complexity and no need for user interaction. Successful exploitation allows arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full remote code execution (RCE) on the device.

Advisories and references, including VulDB entries (ctiid.344885, id.344885) and GitHub repositories from cha0yang1/UTT521G, document the issue but do not specify patches or vendor-provided mitigations. The references include a detailed proof-of-concept (POC) for RCE, confirming public exploit availability.

Exploitation is feasible in real-world scenarios due to the disclosed POC, heightening risks for exposed UTT 进取 521G devices until firmware updates are applied.

EU & UK References

Vulnerability details

A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely.…

more

The exploit has been made available to the public and could be used for attacks.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command injection in exposed web form (/goform/setSysAdm) directly enables exploitation of public-facing network device for RCE via Unix shell commands.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-2188Same product: Utt 521G
CVE-2026-2135Same vendor: Utt
CVE-2026-2080Same vendor: Utt
CVE-2026-2118Same vendor: Utt
CVE-2025-13442Same vendor: Utt
CVE-2026-31059Same vendor: Utt
CVE-2026-2846Same vendor: Utt
CVE-2026-2847Same vendor: Utt
CVE-2026-2194Shared CWE-74, CWE-77
CVE-2026-2218Shared CWE-74, CWE-77

Affected Assets

utt
521g firmware
3.1.1-190816

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires validation and sanitization of the passwd1 argument in /goform/setSysAdm to block command injection into doSystem.

prevent

Restricts administrative accounts that can reach the vulnerable setSysAdm function, limiting the population able to supply malicious passwd1 values.

respondrecover

Mandates timely application of firmware patches that remediate the command-injection flaw in the UTT 521G web interface.

References