CVE-2026-2847
Published: 20 February 2026
Summary
CVE-2026-2847 is a high-severity Command Injection (CWE-77) vulnerability in Utt 520 Firmware. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in authenticated web management interface directly enables T1190 (exploit public-facing app) and T1059.004 (Unix shell command execution on embedded firmware).
NVD Description
A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched…
more
remotely. The exploit is now public and may be used.
Deeper analysisAI
CVE-2026-2847 is an OS command injection vulnerability (CWE-77, CWE-78) affecting UTT HiPER 520 firmware version 1.7.7-160105. The flaw resides in the sub_44EFB4 function of the /goform/formReleaseConnect file within the Web Management Interface component. Manipulation of the Isp_Name argument enables command injection, as disclosed on February 20, 2026, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability is exploitable remotely by authenticated users possessing high privileges, such as administrative access to the Web Management Interface. Attackers can inject and execute arbitrary OS commands on the underlying system, achieving high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.
Advisories reference a public exploit at https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE2.md, along with VulDB entries at https://vuldb.com/?ctiid.347083, https://vuldb.com/?id.347083, and https://vuldb.com/?submit.753965. Security practitioners should review these sources for mitigation guidance, including potential firmware updates or access controls, given the public availability of the exploit.
Details
- CWE(s)