What is the CVSS score of CVE-2026-52197?

CVE-2026-52197 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of UTT nv518G are affected by CVE-2026-52197?

The UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) is vulnerable to remote denial-of-service attacks that crash or hang the device without requiring authentication, potentially taking…

How to fix or mitigate CVE-2026-52197?

Within 24 hours: Inventory all UTT nv518G routers deployed across your organization and identify affected firmware versions. Within 7 days: Implement network segmentation to isolate these devices from untrusted networks; restrict administrative interface access to specific trusted IP ranges or VPN; disable remote management if not operationally required. Within 30 days: Develop and execute a replacement strategy with alternative router models or patched firmware versions (when available from UTT), prioritizing replacement of devices in business-critical network segments.

UTT nv518G CVE-2026-52197

EUVD-2026-40867 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-30 mitre

GHSA-pj2j-v5vq-rq7x

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote crash of the unauthenticated gohead service (AV:N/AC:L/PR:N/UI:N) with availability-only impact (A:H, C:N/I:N); no scope change, consistent with the supplied vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:27 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 component

AnalysisAI

Denial of service in the UTT nv518G router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash or hang the device by sending crafted input to the gohead/sub_44af70 (FUN_0044af70) component of its embedded web/management service. Rated CVSS 7.5 (availability-only impact), the flaw is network-reachable without authentication or user interaction but does not expose or alter data. A public technical writeup analyzing the vulnerable function exists on GitHub; there is no public evidence of active exploitation and EPSS scores it low (0.20%, 11th percentile).

Technical ContextAI

The affected device is a UTT (Shanghai UTT Technologies) nv518G small-business/SOHO router, a Chinese-market networking appliance whose administrative and service functions are handled by an embedded HTTP server ('gohead' - a GoAhead-style lightweight web server commonly used in embedded firmware). The vulnerable routine, identified by its reverse-engineered address gohead/sub_44af70 (FUN_0044af70), mishandles attacker-supplied request data. CWE-400 (Uncontrolled Resource Consumption) is the root-cause class: the function fails to bound the resources (memory, CPU, buffer, or a processing loop) consumed while parsing the request, so a malicious request drives the process or device into an unrecoverable state. The CPE provided by the source is a placeholder (cpe:2.3:a:n/a:n/a:*), so the affected component is only pinned by the vendor firmware string rather than an authoritative CPE.

RemediationAI

No vendor-released patched firmware version is identified at time of analysis; the CVE and EUVD records contain no fix version, and only the general UTT download center is referenced. Administrators should check the UTT download center (https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn) for firmware newer than nv518GV3v3.2.7-210919-161313 and apply it once available. Until a fix ships, the most effective compensating control is to ensure the router's web/management interface (the gohead service) is not exposed to the WAN/Internet - disable remote/WAN administration and restrict management access to a trusted management VLAN or specific admin IPs via ACL; the trade-off is loss of remote administration convenience. Additionally, block or filter untrusted access to the management HTTP(S) port at an upstream firewall, and monitor the device for unexpected reboots or unresponsiveness as an indicator of exploitation attempts. Because impact is a crash/DoS only, a scheduled watchdog reboot or availability monitoring can reduce downtime but does not prevent the attack.