PT-2026-21023 · Unknown · Utt Hiper 520

Ruler-Chovy · Published 2026-02-20 · Updated 2026-02-23 · CVE-2026-2846

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 520 version 1.7.7-160105

Description A security issue exists in UTT HiPER 520. The sub 44D264 function within the /goform/formPdbUpConfig file of the Web Management Interface is susceptible to operating system command injection. This occurs through manipulation of the policyNames argument, and the attack can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Apply a fix to the sub 44D264 function in the /goform/formPdbUpConfig file to prevent manipulation of the policyNames argument.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-2846

Affected Products

Utt Hiper 520

References · 8

• 🔥 https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE1.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-2846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2846 · Security Note
• https://vuldb.com/?id.347082 · Note
• https://vuldb.com/?submit.753964 · Note
• https://vuldb.com/?ctiid.347082 · Note
• https://twitter.com/CVEnew/status/2025809074919755892 · Twitter Post
• https://t.me/CVEtracker/45287 · Telegram Post