Cyber Resilience

CVE-2026-31059

CriticalPublic PoCRCE

Published: 06 April 2026

Published
06 April 2026
Modified
09 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0090 55.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-31059 is a critical-severity Command Injection (CWE-77) vulnerability in Utt 520W Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-31059 is a remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627. Published on 2026-04-06, it enables attackers to execute arbitrary commands via a crafted string and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The issue is classified under CWE-77 (Command Injection).

The vulnerability can be exploited over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation grants high-impact access, allowing full control over confidentiality, integrity, and availability of the affected device through arbitrary command execution.

Details on the vulnerability, including potential exploitation information, are documented in the GitHub repository at https://github.com/zxq0408/Vul202601/blob/main/9.md. No vendor advisories or patches are specified in available references.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

CVE enables unauthenticated RCE via command injection (CWE-77) in public-facing web component (/goform/formDia), directly mapping to T1190 (Exploit Public-Facing Application) and facilitating Unix Shell command execution (T1059.004) on likely Linux-based network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-0836Same product: Utt 520W
CVE-2025-15460Same product: Utt 520W
CVE-2025-15459Same product: Utt 520W
CVE-2026-0839Same product: Utt 520W
CVE-2026-2066Same product: Utt 520W
CVE-2026-2067Same product: Utt 520W
CVE-2026-1139Same product: Utt 520W
CVE-2025-15462Same product: Utt 520W
CVE-2026-0840Same product: Utt 520W
CVE-2026-0837Same product: Utt 520W

Affected Assets

utt
520w firmware
1.7.7-180627

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of all information inputs to the /goform/formDia component, directly preventing command injection via crafted strings.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and correction of flaws like this command injection vulnerability in the device firmware.

SC-7 Boundary Protection partial match
preventdetect

Monitors and controls network communications to external interfaces, blocking or detecting unauthenticated remote access to the vulnerable /goform/formDia endpoint.

References