CVE-2026-2847
Published: 20 February 2026
Summary
CVE-2026-2847 is a high-severity Command Injection (CWE-77) vulnerability in Utt 520 Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-2847 is an OS command injection vulnerability (CWE-77, CWE-78) affecting UTT HiPER 520 firmware version 1.7.7-160105. The flaw resides in the sub_44EFB4 function of the /goform/formReleaseConnect file within the Web Management Interface component. Manipulation of the Isp_Name argument enables command injection, as disclosed on February 20, 2026, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is exploitable remotely by authenticated users possessing high privileges, such as administrative access to the Web Management Interface. Attackers can inject and execute arbitrary OS commands on the underlying system, achieving high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.
Advisories reference a public exploit at https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE2.md, along with VulDB entries at https://vuldb.com/?ctiid.347083, https://vuldb.com/?id.347083, and https://vuldb.com/?submit.753965. Security practitioners should review these sources for mitigation guidance, including potential firmware updates or access controls, given the public availability of the exploit.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8468
Vulnerability details
A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched…
more
remotely. The exploit is now public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in authenticated web management interface directly enables T1190 (exploit public-facing app) and T1059.004 (Unix shell command execution on embedded firmware).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the Isp_Name argument before it reaches sub_44EFB4, blocking OS command injection at the web form.
Restricts the high-privilege accounts that can reach /goform/formReleaseConnect, reducing the population able to supply malicious input.
Enforces boundary filtering or isolation rules that can block or limit remote access to the vulnerable Web Management Interface endpoint.