EUVD-2026-19267
GHSA-4c3f-9h8p-j5x9
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.
AnalysisAI
Remote command execution in UTT Aggressive 520W v3v1.7.7-180627 via the /goform/formReleaseConnect component allows authenticated attackers with high privileges to execute arbitrary system commands through a crafted string parameter, resulting in complete system compromise (confidentiality, integrity, and availability impact). No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
The vulnerability exists in the formReleaseConnect request handler of the UTT Aggressive 520W router firmware, a network appliance device commonly deployed in enterprise and ISP environments. The root cause is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input from the crafted string parameter is passed unsanitized to system command execution functions without proper escaping or validation. The component fails to implement adequate input validation or parameterization, allowing shell metacharacters or command separators to be interpreted as part of the executed command rather than data.
RemediationAI
The primary remediation is to upgrade UTT Aggressive 520W firmware to a patched version released by the vendor; however, exact patched version numbers were not specified in the available reference data. Organizations should contact UTT directly or consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31067 for specific patch availability and version guidance. As an interim mitigation, restrict network access to the /goform/formReleaseConnect component and the device management interface to trusted administrative networks only, using firewall rules or VPN-based access controls to limit the attack surface to adjacent network connectivity. Implement principle of least privilege by auditing which administrative accounts have access to the device and ensure only authorized personnel retain high-privilege credentials. Monitor device logs for suspicious command patterns or formReleaseConnect requests originating from unexpected sources.
More in 520w Firmware
View allA flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formA
Remote code execution in UTT 520W firmware via stack-based buffer overflow in the /goform/formPictureUrl endpoint allows
Remote code execution in UTT 520W firmware (version 1.7.7-180627) via a stack buffer overflow in the /goform/formConfigN
Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allow
Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows
Remote code execution in UTT 520W firmware versions through 1.7.7-180627 stems from a buffer overflow in the /goform/for
Unauthenticated attackers can exploit a buffer overflow in the UTT 520W Firmware's P2P configuration function via a craf
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 through a buffer overflow in the /goform/formPoli
Remote code execution in UTT 520W firmware 1.7.7-180627 allows authenticated attackers to execute arbitrary code via a b
Remote code execution in UTT 520W firmware through a buffer overflow in the /goform/formTimeGroupConfig endpoint allows
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 via stack buffer overflow in the /goform/formIpGr
Remote code execution in UTT 520W firmware 1.7.7-180627 via a buffer overflow in the /goform/ConfigExceptAli endpoint al
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today