What is the CVSS score of CVE-2026-31059?

CVE-2026-31059 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of 520w Firmware are affected by CVE-2026-31059?

UTT Aggressive HiPER 520W routers running firmware v1.7.7-180627 are vulnerable to unauthenticated remote command execution with critical severity (CVSS 9.8), allowing attackers to fully compromise…

How to fix or mitigate CVE-2026-31059?

Within 24 hours: Inventory all UTT Aggressive HiPER 520W devices and identify those running firmware v1.7.7-180627; isolate affected units from production networks or internet-facing roles if possible. Within 7 days: Contact UTT for firmware update availability and verify if v1.7.8 or later patches this vulnerability; apply updates immediately upon availability. Within 30 days: Implement network segmentation (VLAN isolation) and restrict management access via firewall rules; conduct network forensics on affected devices for signs of compromise; evaluate replacement with vendor-patched models or alternative router solutions if no patch timeline is provided.

520w Firmware CVE-2026-31059

EUVD-2026-19253 CRITICAL

Command Injection (CWE-77)

2026-04-06 cve@mitre.org

GHSA-78px-96jw-rr5f

Command Injection 520w Firmware Utt

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19253

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

CRITICAL 9.8

DescriptionCVE.org

A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.

AnalysisAI

Remote command execution in UTT Aggressive HiPER 520W router firmware v1.7.7-180627 allows unauthenticated attackers to execute arbitrary system commands via crafted input to the /goform/formDia component. CVSS 9.8 severity indicates network-accessible, low-complexity exploitation requiring no authentication or user interaction. EPSS score of 0.04% (12th percentile) suggests currently low exploitation probability despite publicly available exploit code exists (GitHub POC). No vendor-released patch identified at time of analysis, presenting significant risk for exposed devices.

Technical ContextAI

The vulnerability affects the UTT 520W wireless router's web management interface, specifically the /goform/formDia endpoint (CPE: cpe:2.3:o:utt:520w_firmware:1.7.7-180627). This is a CWE-77 command injection flaw where the firmware fails to properly sanitize user-supplied input before passing it to system shell commands. The /goform/ path typically handles form submissions in embedded device web interfaces. Attackers can inject shell metacharacters or command separators in HTTP parameters processed by formDia, causing the router to execute attacker-controlled commands with the privileges of the web server process, typically root on embedded Linux devices. This class of vulnerability is common in SOHO router firmware where input validation is frequently insufficient in legacy codebases.

RemediationAI

No vendor-released patch identified at time of analysis for UTT 520W firmware v1.7.7-180627. Organizations operating affected devices should immediately implement network-level compensating controls: restrict management interface access to trusted IP addresses only via firewall rules, disable remote management features if not operationally required, place devices behind VPN or jump host infrastructure for administrative access, and implement network segmentation to isolate router management planes from untrusted networks. Monitor UTT's official support channels and security advisories for firmware updates addressing CVE-2026-31059. Given the 2018 firmware build date, assess whether this hardware model remains within vendor support lifecycle-end-of-life devices may never receive patches and should be considered for hardware replacement with currently-supported alternatives. Deploy intrusion detection signatures to monitor for HTTP POST requests to /goform/formDia containing shell metacharacters or command injection patterns. Reference the proof-of-concept at https://github.com/zxq0408/Vul202601/blob/main/9.md for attack pattern indicators to inform defensive rules.