520w Firmware CVE-2026-31059

Remote unauthenticated attacker can exploit the /goform/formDia component in UTT Aggressive HiPER 520W v3v1.7.7-180627 by sending a crafted string. No authentication, user interaction, or special configuration required.

Risk assessment reveals a significant divergence between theoretical severity and observed exploitation activity. The CVSS 9.8 (Critical) score accurately reflects maximum theoretical impact: network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability. However, EPSS probability of 0.04% (12th percentile) indicates minimal observed exploitation attempts in real-world telemetry, likely due to the limited deployment footprint of this specific UTT router model. Publicly available exploit code exists per the GitHub reference, lowering the skill barrier for exploitation, yet no CISA KEV listing suggests threat actors are not actively targeting this vulnerability at scale. SSVC factors: exploitation is public (POC available), likely automatable given the web-based attack vector and lack of authentication requirements, and technical impact is total system compromise. Priority depends on organizational exposure-critical for networks deploying affected UTT 520W devices, but lower urgency for organizations without this hardware. The combination of unauthenticated remote access and command injection makes this highly dangerous for any exposed device, but the narrow product scope limits widespread impact.

An external attacker scans the internet for UTT 520W routers with exposed management interfaces on TCP ports 80 or 443. Upon identifying the vulnerable firmware version through HTTP banner fingerprinting or login page characteristics, the attacker crafts an HTTP POST request to the /goform/formDia endpoint containing a malicious payload with shell command separators (such as semicolons, pipes, or backticks) embedding commands like reverse shell establishment, credential harvesting, or network reconnaissance tools. The router's web server processes this input without sanitization, executing the injected commands with root privileges. The attacker gains complete control of the device, enabling man-in-the-middle attacks on network traffic, persistent backdoor installation, pivoting to internal network segments, DNS hijacking, or using the compromised router as a bot in larger attack campaigns. Publicly available exploit code exists demonstrating this attack path, requiring only minimal adaptation for operational use.