What is the CVSS score of EUVD-2026-40866?

EUVD-2026-40866 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of UTT nv518G are affected by EUVD-2026-40866?

The UTT nv518G gateway/router running firmware nv518GV3v3.2.7-210919-161313 is exposed to remote unauthenticated denial-of-service attacks via a buffer overflow in its web service, with publicly…

How to fix or mitigate EUVD-2026-40866?

24 hours: Identify all UTT nv518G devices on the network; assess which are internet-facing or handle critical traffic; disable external access to the web management interface where operationally possible. 7 days: Deploy rate limiting and WAF rules targeting buffer overflow attacks; segment affected gateways from untrusted networks; activate monitoring and alerting for exploitation patterns. 30 days: Contact UTT support for patch timeline; if no patch emerges, develop and execute a device replacement or firmware update plan.

UTT nv518G EUVD-2026-40866

| CVE-2026-52196 HIGH

Classic Buffer Overflow (CWE-120)

2026-06-30 cve@mitre.org

GHSA-5j4v-722p-7pmr

Buffer Overflow Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable gohead service exploitable without auth or interaction (AV:N/AC:L/PR:N/UI:N); buffer overflow only crashes the device, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:32 vuln.today

CVSS changed

Jul 01, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jun 30, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 component

AnalysisAI

Denial of service in the UTT nv518G gateway/router (firmware nv518GV3v3.2.7-210919-161313) lets a remote, unauthenticated attacker crash the device by triggering a buffer overflow in the gohead web-service function sub_416f28 (FUN_00416f28). Publicly available exploit code exists (referenced PoC on GitHub), though the flaw is not listed in CISA KEV and EPSS scores it at just 0.22% (13th percentile), indicating low observed exploitation activity. Impact is limited to availability - no code execution or data exposure is claimed in the source data.

Technical ContextAI

The affected component is 'gohead', the embedded HTTP/management daemon on UTT's nv518G series gateway (a small-business router/VPN gateway from the Chinese vendor UTT, utt.com.cn). The vulnerable routine sub_416f28 (labeled FUN_00416f28 in the referenced Ghidra/IDA analysis) is reachable over the network and mishandles attacker-supplied input. The root cause is CWE-120, Classic Buffer Copy without Checking Size of Input ('Buffer Overflow') - data is copied into a fixed-size stack or heap buffer without bounds validation, corrupting adjacent memory and crashing the daemon. On embedded MIPS/ARM router firmware such overflows commonly halt the web management service or reboot the device rather than yield reliable control-flow hijack, which is consistent with the availability-only impact recorded here.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the available data, so a specific upgrade target cannot be cited; monitor the UTT download center (https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn) for an updated nv518G firmware build superseding nv518GV3v3.2.7-210919-161313. As compensating controls, restrict reachability of the gohead web management interface: bind management to the LAN only and block WAN/internet access to the device's HTTP(S) management port via an upstream firewall ACL (side effect - remote administration must then be done over a VPN or from the LAN), and apply source-IP allowlisting to the management interface so only trusted admin hosts can reach it (side effect - legitimate roaming admins are blocked until their address is added). Because the impact is a crash/reboot, also ensure the device is not the sole path for critical traffic and consider rate-limiting or dropping malformed requests at an upstream proxy. Consult the report at https://github.com/akuma-QAQ/CVEreport/tree/main/518G/FUN_00416f28 for the exact triggering request.