What is the CVSS score of CVE-2026-52199?

CVE-2026-52199 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of UZ801 LTE Router are affected by CVE-2026-52199?

The Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 contains a critical unauthenticated remote code execution vulnerability allowing network-accessible attackers to gain complete control of…

How to fix or mitigate CVE-2026-52199?

Within 24 hours, conduct a complete inventory of Generic OEM UZ801_v2.1 4G LTE Router devices running firmware V3.4.3 and immediately restrict network access to these units or isolate them from production environments. Within 7 days, implement network segmentation limiting router communications to necessary administrative channels, deploy intrusion detection signatures targeting the exposed adbd component, and contact the OEM to assess whether security-hardened firmware upgrades or alternative solutions are available. Within 30 days, execute a replacement program to transition affected routers to vendor-supported alternatives with active security maintenance, or if replacement is infeasible, establish continuous monitoring and network access controls with quarterly risk assessments.

UZ801 LTE Router CVE-2026-52199

CRITICAL

Command Injection (CWE-77)

2026-07-17 mitre

RCE Command Injection N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.8 CRITICAL

Exposed adbd grants an unauthenticated remote root/system shell (AV:N/AC:L/PR:N/UI:N), so full C/I/A high; raised A to H versus the source since shell access also enables disruption.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:27 vuln.today

CVSS changed

Jul 20, 2026 - 19:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 17, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

AnalysisAI

Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 allows an unauthenticated remote attacker to run arbitrary commands through the exposed sbin/adbd (Android Debug Bridge daemon) component. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact, reflecting full command execution on the device. No CISA KEV listing is present and EPSS is low (0.35%, 27th percentile), but a researcher GitHub repository is referenced, indicating publicly available exploit code likely exists.

Technical ContextAI

The affected component, sbin/adbd, is the Android Debug Bridge daemon - a debug service inherited from the Qualcomm/Android-derived platform on which many of these inexpensive USB/4G LTE dongle-routers (typically MSM8916-class hardware) are built. When adbd is left running and reachable over the network interface, it exposes a shell/exec transport that was designed for trusted local development, not remote production exposure. The mapped weakness CWE-77 (Improper Neutralization of Special Elements used in a Command / Command Injection) indicates that input reaching this interface is passed into a command context without adequate validation, yielding arbitrary command execution. The CPE string provided ('cpe:2.3:a:n/a:n/a:*') is a placeholder ('n/a') and does not identify the product, so exact product identification relies on the description text rather than structured NVD CPE data.

RemediationAI

No vendor-released patch identified at time of analysis, which is typical for generic-OEM/white-label hardware lacking a maintained update channel. The primary compensating control is to disable or firewall the exposed adbd service: block inbound access to the ADB transport (default TCP 5555) at the network perimeter and on any WAN/cellular-facing interface, and if the firmware exposes an option, turn off ADB/USB-debugging entirely - the trade-off is loss of any legitimate remote-debug capability, which is rarely needed in production. Restrict device management to a trusted local/VPN network segment and place the router behind an upstream firewall so the LTE-facing interface does not accept unsolicited inbound connections; the trade-off is added deployment complexity. Where the device role permits, replacing the affected UZ801 hardware with a maintained, patchable router is the most durable fix. Consult the referenced repository (https://github.com/lamaper/CVE-2026-52199) for technical detail, but do not treat researcher PoC code as a remediation source.