UZ801 LTE Router CVE-2026-52199
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan for exposed ADB port
-
DeliveryConnect to sbin/adbd daemon
-
ExploitInject commands via unauthenticated interface
-
ExecutionExecute arbitrary code as system
-
ImpactPivot to LAN or persist
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the vulnerable device be running firmware V3.4.3 with the sbin/adbd (Android Debug Bridge) service active and reachable from the attacker's network path - i.e., the ADB transport must be listening on a WAN/cellular- or LAN-facing interface rather than being disabled or bound only to USB. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed once the daemon is reachable. The principal limiting factors are network reachability of the adbd port (devices behind carrier CGNAT or an upstream firewall that blocks the ADB port are not remotely exploitable) and the specific affected UZ801_v2.1 / V3.4.3 firmware; deployments where ADB debugging is disabled are not exploitable. |
| Impact | Signals here are mixed and must be weighed rather than taken at face value. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a textbook high-severity remote, unauthenticated, low-complexity RCE, which normally warrants urgent prioritization. However, EPSS is low at 0.35% (27th percentile) and there is no CISA KEV listing, suggesting no evidence of widespread active exploitation to date. This is consistent with a niche, generic-OEM consumer device that is not a high-value mass-exploitation target rather than with a benign issue. The presence of a dedicated researcher GitHub reference raises the practical exploitability above what EPSS alone implies, since working exploit code lowers the barrier to opportunistic attacks. One notable inconsistency: the supplied vector sets A:N (no availability impact), yet abuse of adbd typically grants an interactive root/system shell that would also enable service disruption - verify impact scoping with the source. Net assessment: genuinely high technical risk for any exposed device, tempered by limited real-world footprint and no confirmed in-the-wild exploitation. |
| Exploit ScenarioDerived | An attacker scans cellular/WAN address ranges for devices with an open ADB port, connects to the exposed sbin/adbd service on a UZ801 router, and - because no authentication is required - issues commands that execute directly on the device. With publicly referenced exploit code, this can be automated to obtain a root/system shell, pivot into the LAN behind the router, or enroll the device into a botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 allows an unauthenticated remote attacker to run arbitrary commands through the exposed sbin/adbd (Android Debug Bridge daemon) component. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) with high confidentiality and integrity impact, reflecting full command execution on the device. No CISA KEV listing is present and EPSS is low (0.35%, 27th percentile), but a researcher GitHub repository is referenced, indicating publicly available exploit code likely exists.
RemediationAI
No vendor-released patch identified at time of analysis, which is typical for generic-OEM/white-label hardware lacking a maintained update channel. The primary compensating control is to disable or firewall the exposed adbd service: block inbound access to the ADB transport (default TCP 5555) at the network perimeter and on any WAN/cellular-facing interface, and if the firmware exposes an option, turn off ADB/USB-debugging entirely - the trade-off is loss of any legitimate remote-debug capability, which is rarely needed in production. Restrict device management to a trusted local/VPN network segment and place the router behind an upstream firewall so the LTE-facing interface does not accept unsolicited inbound connections; the trade-off is added deployment complexity. Where the device role permits, replacing the affected UZ801 hardware with a maintained, patchable router is the most durable fix. Consult the referenced repository (https://github.com/lamaper/CVE-2026-52199) for technical detail, but do not treat researcher PoC code as a remediation source.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component, sbin/adbd, is the Android Debug Bridge daemon - a debug service inherited from the Qualcomm/Android-derived platform on which many of these inexpensive USB/4G LTE dongle-routers (typically MSM8916-class hardware) are built. When adbd is left running and reachable over the network interface, it exposes a shell/exec transport that was designed for trusted local development, not remote production exposure. The mapped weakness CWE-77 (Improper Neutralization of Special Elements used in a Command / Command Injection) indicates that input reaching this interface is passed into a command context without adequate validation, yielding arbitrary command execution. The CPE string provided ('cpe:2.3:a:n/a:n/a:*') is a placeholder ('n/a') and does not identify the product, so exact product identification relies on the description text rather than structured NVD CPE data.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exposed adbd grants an unauthenticated remote root/system shell (AV:N/AC:L/PR:N/UI:N), so full C/I/A high; raised A to H versus the source since shell access also enables disruption.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component
Executive ViewAI
The Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3 contains a critical unauthenticated remote code execution vulnerability allowing network-accessible attackers to gain complete control of affected devices. Compromised routers enable threat actors to intercept, modify, and redirect network traffic, directly threatening data confidentiality and organizational network integrity. Organizations operating this router model face immediate operational risk without vendor-provided security patches.
No vendor-released patch identified at time of analysis. Publicly available exploit code exists. Interim mitigations include: (1) network segmentation restricting router access to trusted administrative hosts only; (2) firewall rules blocking unnecessary access to the exposed adbd service; (3) intrusion detection/prevention signatures monitoring for exploitation attempts; (4) device isolation or decommissioning if operationally feasible; (5) urgent outreach to OEM regarding security updates or firmware alternatives. Replacement with vendor-supported routers is the critical long-term mitigation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB