CVE-2026-2182
Published: 08 February 2026
Summary
CVE-2026-2182 is a high-severity Injection (CWE-74) vulnerability in Utt 521G Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 35.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in exposed web form (/goform/setSysAdm) directly enables exploitation of public-facing network device for RCE via Unix shell commands.
NVD Description
A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely.…
more
The exploit has been made available to the public and could be used for attacks.
Deeper analysisAI
CVE-2026-2182 is a command injection vulnerability affecting the UTT 进取 521G router running firmware version 3.1.1-190816. The flaw exists in the doSystem function of the /goform/setSysAdm component, where the passwd1 argument can be manipulated to inject and execute arbitrary commands. Published on 2026-02-08, it is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network by authenticated users possessing high privileges. Attackers require administrative access but face low complexity and no need for user interaction. Successful exploitation allows arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full remote code execution (RCE) on the device.
Advisories and references, including VulDB entries (ctiid.344885, id.344885) and GitHub repositories from cha0yang1/UTT521G, document the issue but do not specify patches or vendor-provided mitigations. The references include a detailed proof-of-concept (POC) for RCE, confirming public exploit availability.
Exploitation is feasible in real-world scenarios due to the disclosed POC, heightening risks for exposed UTT 进取 521G devices until firmware updates are applied.
Details
- CWE(s)