EUVD-2026-19253
GHSA-78px-96jw-rr5f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.
AnalysisAI
Remote command execution in UTT Aggressive HiPER 520W router firmware v1.7.7-180627 allows unauthenticated attackers to execute arbitrary system commands via crafted input to the /goform/formDia component. CVSS 9.8 severity indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit the /goform/formDia component in UTT Aggressive HiPER 520W v3v1.7.7-180627 by sending a crafted string. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk assessment reveals a significant divergence between theoretical severity and observed exploitation activity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An external attacker scans the internet for UTT 520W routers with exposed management interfaces on TCP ports 80 or 443. Upon identifying the vulnerable firmware version through HTTP banner fingerprinting or login page characteristics, the attacker crafts an HTTP POST request to the /goform/formDia endpoint containing a malicious payload with shell command separators (such as semicolons, pipes, or backticks) embedding commands like reverse shell establishment, credential harvesting, or network reconnaissance tools. … |
| Remediation | No vendor-released patch identified at time of analysis for UTT 520W firmware v1.7.7-180627. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all UTT Aggressive HiPER 520W devices and identify those running firmware v1.7.7-180627; isolate affected units from production networks or internet-facing roles if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today