HIGH🇵🇱 Wersja polska

CVE-2026-2080

CVSS 7.3v4.0pub. 2026-02-07upd. 2026-02-13

A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Utt 810

    HW
    Utt
    4.0

  • Utt 810 Firmware

    OS
    Utt
    1.7.4-141218
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-70998CRITICAL9.8PL ✓same product

Domyślne dane logowania w firmware UTT HiPER 810 — dostęp root przez telnet

CVE-2026-2118HIGH7.3same product

A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 ...

CVE-2026-1162HIGH8.9same product

A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /...

CVE-2026-2135LOW2.1same product

W systemie UTT HiPER 810 w wersji 1.7.4-141218 wykryto podatność. Podatny element to funkcja sub_43F020 w plik...

CVE-2026-31059CRITICAL9.8PL ✓same vendor

RCE w UTT HiPER 520W — wykonanie dowolnych poleceń przez /goform/formDia