PT-2026-6938 · Unknown · Utt Hiper 810

Cha0Yang · Publicado 2026-02-08 · Atualizado 2026-02-13 · CVE-2026-2118

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218

Description A flaw exists in the rehttpd component of UTT HiPER 810. Specifically, the sub 4407D4 function within the /goform/formReleaseConnect file is susceptible to command injection. Manipulating the Isp Name argument can allow for remote execution of commands. The exploit for this issue has been publicly disclosed.

Recommendations Apply updates to address the vulnerability in the sub 4407D4 function of the /goform/formReleaseConnect file. As a temporary workaround, restrict or disable the use of the Isp Name argument.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

CVE-2026-2118

Produtos afetados

Utt Hiper 810

Referências · 12

• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md · Exploit
• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md#poc · Exploit
• https://twitter.com/CVEnew/status/2020356555288285241 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2118 · Nota de Segurança
• https://vuldb.com/?submit.746802 · Nota
• https://osv.dev/vulnerability/CVE-2026-2118 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2022264538041901471 · Publicação no Twitter
• https://vuldb.com/?id.344693 · Nota
• https://vuldb.com/?ctiid.344693 · Nota
• https://t.me/CVEtracker/44067 · Publicação no Telegram
• https://t.me/cveNotify/151982 · Publicação no Telegram
• https://t.me/cveNotify/151268 · Publicação no Telegram