PT-2026-6898 · Unknown · Utt Hiper 810

Cha0Yang · Published 2026-02-07 · Updated 2026-02-13 · CVE-2026-2080

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218

Description A flaw exists in the setSysAdm function within the /goform/formUser file. Manipulating the passwd1 argument can lead to command injection. Remote exploitation is possible. The details of the exploit have been publicly disclosed. The vendor was informed of this disclosure but did not respond.

Recommendations Apply a fix for the vulnerability in the setSysAdm function within the /goform/formUser file. As a temporary workaround, restrict access to the setSysAdm function until a patch is available. Avoid using the passwd1 parameter in the /goform/formUser file until the issue is resolved.

Exploit

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2026-2080

Affected Products

Utt Hiper 810

References · 10

• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/README.md#reproduction-steps · Exploit
• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2026-2080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2080 · Security Note
• https://vuldb.com/?id.344646 · Note
• https://t.me/CVEtracker/44033 · Telegram Post
• https://vuldb.com/?ctiid.344646 · Note
• https://twitter.com/CVEnew/status/2020071685680976337 · Twitter Post
• https://vuldb.com/?submit.745521 · Note
• https://t.me/cveNotify/151981 · Telegram Post