CVE-2026-2188
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability was determined in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
Analysis
Remote code execution in UTT 521G firmware 3.1.1-190816 allows unauthenticated attackers to inject arbitrary OS commands through the policyNames parameter in the /goform/formPdbUpConfig endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Audit all UTT 进取 521G devices in your environment and document their network locations and criticality. Within 7 days: Implement network segmentation to restrict access to affected devices' management interfaces, disable the /goform/formPdbUpConfig endpoint if operationally feasible, and deploy WAF rules to block malicious requests to this function. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today