What is the CVSS score of CVE-2026-52198?

CVE-2026-52198 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of UTT nv518G are affected by CVE-2026-52198?

The UTT nv518G gateway/router running firmware nv518GV3v3.2.7 and earlier is vulnerable to remote denial of service attacks that crash the device, potentially disrupting network access for affected…

How to fix or mitigate CVE-2026-52198?

Within 24 hours: Identify and inventory all UTT nv518G devices running firmware version nv518GV3v3.2.7 or earlier, implement network segmentation to restrict direct access to the gateway management interface, and deploy IPS/WAF rules to detect and block buffer overflow attempts targeting the vulnerable sub_425994 routine. Within 7 days: Enable rate limiting and request throttling on all web-server access to affected devices, configure automated alerts for abnormal traffic patterns and failed requests, and document firmware versions in your asset management system. Within 30 days: Continuously monitor UTT vendor advisories for patch availability, evaluate replacement timelines if patches remain unavailable beyond 60 days, and conduct a supply chain review for alternative gateway products with active security support.

UTT nv518G CVE-2026-52198

EUVD-2026-40868 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-30 cve@mitre.org

GHSA-w7hc-jqc4-9j5c

Buffer Overflow Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated low-complexity request to the web server (AV:N/AC:L/PR:N/UI:N); described impact is a denial of service, so A:H with C:N/I:N rather than the input's C:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 18:48 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

DescriptionCVE.org

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_425994 component

AnalysisAI

Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) allows a remote attacker to crash the device by triggering a buffer overflow in the gohead/sub_425994 (FUN_00425994) web-server routine. Publicly available exploit/PoC documentation exists (GitHub CVEreport), and the SSVC framework rates exploitation as PoC-stage and automatable, though EPSS remains low at 0.22% (13th percentile) with no confirmed active exploitation.

Technical ContextAI

UTT nv518G is a SOHO/enterprise network gateway (router/firewall) from Shanghai UTT Technologies, a Chinese networking vendor. The flaw lives in 'gohead', which is the GoAhead-derived embedded HTTP server bundled in the firmware, specifically the internal handler disassembled as sub_425994/FUN_00425994. CWE-120 (Classic Buffer Overflow - buffer copy without checking input size) indicates the handler copies attacker-controlled request data into a fixed-size stack or heap buffer without bounds checking, allowing memory corruption that crashes the web service or the device.

RemediationAI

No vendor-released patch version is identified at time of analysis; the only vendor pointer is the UTT firmware download center (https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn), which should be checked for an updated 518G firmware build newer than v3.2.7-210919-161313. As compensating controls, restrict access to the device's web-management interface so it is not reachable from the WAN/Internet - bind management to the LAN only or place it behind a firewall ACL, which removes the AV:N exposure at the cost of losing remote administration convenience. Additionally, limit management access to a trusted management VLAN or specific source IPs, and monitor for unexpected reboots or web-server crashes as an indicator of exploitation attempts. Technical details and PoC context are documented at https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00425994/README.md.