What is the CVSS score of CVE-2026-52200?

CVE-2026-52200 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of UZ801 4G Router are affected by CVE-2026-52200?

The Generic OEM UZ801_v2.1 4G LTE Router (firmware V3.4.3) contains a critical remote code execution vulnerability in the MifiService web management interface that allows unauthenticated attackers to…

How to fix or mitigate CVE-2026-52200?

Within 24 hours: Audit network inventory to identify all Generic OEM UZ801_v2.1 units running firmware V3.4.3; map criticality and internet-facing exposure. Within 7 days: Isolate affected routers to restricted network segments, disable remote web management where operationally feasible, and deploy network monitoring for /ajax endpoint access. Within 30 days: Contact OEM for firmware patch timeline; develop device replacement plan or initiate procurement for confirmed-patched alternatives; establish vendor escalation channel for security updates.

UZ801 4G Router CVE-2026-52200

EUVD-2026-42504 CRITICAL

Code Injection (CWE-94)

2026-07-08 cve@mitre.org

GHSA-qcc4-c6xj-c524

RCE Code Injection

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Broken access control on the /ajax API means no authentication (PR:N) and a straightforward request (AC:L) over the network yields code execution with total confidentiality, integrity, and availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:46 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

Jul 08, 2026 - 22:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

AnalysisAI

Remote code execution in the Generic OEM UZ801_v2.1 4G LTE Router (firmware V3.4.3) lets unauthenticated attackers run arbitrary code by sending crafted requests to the /ajax web management API served by the device's MifiService.apk component. The flaw stems from broken access control on the management endpoint, giving remote attackers full control of the device with no credentials. Publicly available exploit code exists on GitHub, though EPSS probability is low (0.24%, 15th percentile) and it is not on the CISA KEV list.

Technical ContextAI

The affected device is a low-cost generic-OEM 4G LTE MiFi/USB router whose management plane runs on an embedded Android userland - the web management logic is implemented in an Android package, MifiService.apk, which exposes an /ajax HTTP API. The vulnerability class is CWE-94 (Improper Control of Generation of Code, i.e. code injection): input reaching the /ajax handler is used to generate or execute code without adequate validation, and the companion reference explicitly frames the root cause as broken access control on that API, meaning the management functions are reachable without authentication. No structured CPE was provided by any source (EUVD lists affected versions as 'n/a'), so the exact affected product must be identified from the description text: OEM UZ801_v2.1 hardware running firmware V3.4.3.

RemediationAI

No vendor-released patch or fixed firmware version was identified at time of analysis, and because this is a generic-OEM device a coordinated vendor advisory may never appear. As compensating controls, ensure the router's web management interface (the /ajax API) is never exposed to the WAN/internet - disable any remote-management or WAN-side admin option and verify with an external port scan; restrict management access to a trusted management VLAN or a single admin host and firewall off the management port from general LAN clients, accepting that this removes convenient over-the-air administration. Where the device supports it, change default credentials and disable unused services, though note that broken access control means authentication alone may not gate the vulnerable endpoint. Monitor the researcher pages (https://github.com/lamaper/CVE-2026-52200 and https://github.com/lamaper/UZ801-MifiService-Broken-Access-Control) and VulDB (https://vuldb.com/vuln/377048) for firmware updates, and treat replacement of the device as the durable fix if the OEM provides no update.