PT-2026-6938 · Unknown · Utt Hiper 810

Cha0Yang · Published 2026-02-08 · Updated 2026-02-13 · CVE-2026-2118

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218

Description A flaw exists in the rehttpd component of UTT HiPER 810. Specifically, the sub 4407D4 function within the /goform/formReleaseConnect file is susceptible to command injection. Manipulating the Isp Name argument can allow for remote execution of commands. The exploit for this issue has been publicly disclosed.

Recommendations Apply updates to address the vulnerability in the sub 4407D4 function of the /goform/formReleaseConnect file. As a temporary workaround, restrict or disable the use of the Isp Name argument.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

CVE-2026-2118

Affected Products

Utt Hiper 810

References · 12

• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md · Exploit
• 🔥 https://github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2118 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2118 · Vendor Advisory
• https://twitter.com/CVEnew/status/2020356555288285241 · Twitter Post
• https://vuldb.com/?submit.746802 · Note
• https://twitter.com/cracbot/status/2022264538041901471 · Twitter Post
• https://vuldb.com/?id.344693 · Note
• https://vuldb.com/?ctiid.344693 · Note
• https://t.me/CVEtracker/44067 · Telegram Post
• https://t.me/cveNotify/151982 · Telegram Post
• https://t.me/cveNotify/151268 · Telegram Post