What is the CVSS score of CVE-2026-52186?

CVE-2026-52186 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of UTT nv518G are affected by CVE-2026-52186?

A critical SQL injection vulnerability (CVE-2026-52186, CVSS 9.8) in UTT nv518G security gateways allows unauthenticated remote code execution on affected devices, with publicly available exploit…

How to fix or mitigate CVE-2026-52186?

Within 24 hours: Execute network scan for UTT nv518G devices; physically or logically isolate affected units from production traffic; document inventory with firmware versions. Within 7 days: Deploy WAF/IDS signatures blocking SQL injection patterns in requests to the gohead/sub_463bbc endpoint; enable debug logging on all affected gateways; review access logs for exploitation attempts. Within 30 days: Contact UTT for patch release date and interim firmware guidance; if timeline exceeds 60 days, initiate replacement procurement or test alternative gateway solutions.

UTT nv518G CVE-2026-52186

EUVD-2026-41224 CRITICAL

SQL Injection (CWE-89)

2026-07-01 cve@mitre.org

GHSA-jqfc-j8hw-pcfx

RCE SQLi

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection in the management interface with reported code execution yields AV:N/AC:L/PR:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 17:00 vuln.today

CVSS changed

Jul 02, 2026 - 14:52 NVD

9.8 (CRITICAL)

CVE Published

Jul 01, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component

AnalysisAI

SQL injection in the UTT nv518G security gateway (firmware nv518GV3v3.2.7-210919-161313) lets remote attackers inject arbitrary SQL through the gohead/sub_463bbc component, which per the advisory escalates to arbitrary code execution on the device. The flaw is unauthenticated (CVSS 9.8, PR:N) and publicly available exploit code exists via a GitHub write-up, though it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), indicating no evidence of widespread automated exploitation yet.

Technical ContextAI

The affected device is a UTT (Shanghai UTT Technologies) nv518G series network gateway/router, a Chinese-market SMB security appliance. The vulnerability is classed as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning attacker-controlled input reaches a backend SQL query without proper sanitization. The vulnerable code lives in the firmware's web/management handler identified as gohead/sub_463bbc (a decompiled function name, FUN_00463bbc, referenced in the researcher's report), suggesting the injection point is exposed through the embedded 'gohead' web server that fronts the device's management interface. Because the appliance is an embedded system, a SQL injection that reaches native handlers can be leveraged for command/code execution rather than mere data disclosure.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the UTT firmware download center (https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn) and a third-party researcher report, not a tagged fixed release, so administrators should check that portal for a firmware build newer than nv518GV3v3.2.7-210919-161313 and contact UTT support to confirm a fix. Until a patched firmware is confirmed, the most effective compensating control is to remove the device's web/management interface (the gohead server hosting the vulnerable handler) from any untrusted or internet-facing network by binding management to a dedicated admin VLAN or restricting it with firewall ACLs to a small set of trusted admin IPs; the trade-off is loss of remote administration convenience. Additionally place the gateway behind a WAF or upstream filtering rule that blocks SQL metacharacters to the vulnerable gohead endpoint (trade-off: possible false positives on legitimate admin traffic), and disable remote/WAN management if the feature is enabled.