CVE-2026-2182
Published: 08 February 2026
Summary
CVE-2026-2182 is a high-severity Injection (CWE-74) vulnerability in Utt 521G Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-2182 is a command injection vulnerability affecting the UTT 进取 521G router running firmware version 3.1.1-190816. The flaw exists in the doSystem function of the /goform/setSysAdm component, where the passwd1 argument can be manipulated to inject and execute arbitrary commands. Published on 2026-02-08, it is classified under CWE-74 (Improper Neutralization of Special Elements) and CWE-77 (Command Injection), with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network by authenticated users possessing high privileges. Attackers require administrative access but face low complexity and no need for user interaction. Successful exploitation allows arbitrary command execution, resulting in high impacts to confidentiality, integrity, and availability, potentially leading to full remote code execution (RCE) on the device.
Advisories and references, including VulDB entries (ctiid.344885, id.344885) and GitHub repositories from cha0yang1/UTT521G, document the issue but do not specify patches or vendor-provided mitigations. The references include a detailed proof-of-concept (POC) for RCE, confirming public exploit availability.
Exploitation is feasible in real-world scenarios due to the disclosed POC, heightening risks for exposed UTT 进取 521G devices until firmware updates are applied.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5768
Vulnerability details
A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely.…
more
The exploit has been made available to the public and could be used for attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in exposed web form (/goform/setSysAdm) directly enables exploitation of public-facing network device for RCE via Unix shell commands.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation and sanitization of the passwd1 argument in /goform/setSysAdm to block command injection into doSystem.
Restricts administrative accounts that can reach the vulnerable setSysAdm function, limiting the population able to supply malicious passwd1 values.
Mandates timely application of firmware patches that remediate the command-injection flaw in the UTT 521G web interface.