CVE-2026-2080

This router has an admin settings page where you're supposed to enter things like a password. The flaw means someone with existing admin access can sneak hidden commands into that password field, and the device will run them as if they came from its own operator — like a locksmith's own key being secretly rigged to also unlock every door in the building.

This matters to you if you run a UTT HiPER 810 router, particularly on firmware version 1.7.4-141218. It only becomes a real risk if an attacker already has admin-level login credentials for the device, since the attack requires that level of access to trigger.

This should be addressed soon: a working exploit has already been published publicly, and interest in this flaw is rising, though there's no confirmed evidence yet of attackers actively using it in real-world attacks. Because there's no vendor patch available, the main protection right now is limiting who can reach the admin interface.

Confirm exposure by checking firmware version via the device admin panel (vulnerable version confirmed: 1.7.4-141218); if the formUser/setSysAdm endpoint is reachable, treat as vulnerable. No official fixed version has been released by UTT at this time — monitor the vendor's support channel for updates, as the vendor did not respond to disclosure attempts. As a workaround, restrict management interface access to a trusted management VLAN or VPN, disable remote/WAN administration, enforce strong unique admin credentials, and audit all accounts with admin privileges since exploitation requires an authenticated high-privilege session. Monitor for unexpected configuration changes, unusual outbound connections from the device, or unexplained reboots. Given the public PoC on GitHub and a rising EPSS trend (currently in the 96th percentile), treat this as a priority to mitigate even though it is not yet in CISA's KEV catalog.

CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) — network-exploitable command injection (CWE-74/CWE-77) requiring high privileges but no user interaction, with high impact to confidentiality, integrity, and availability. A public PoC exploit is available on GitHub; EPSS places this in the 96th percentile with a rising trend, indicating elevated likelihood of future exploitation attempts, though it is not currently listed in CISA's KEV and no confirmed in-the-wild exploitation has been reported. No vendor patch exists; the vendor has not responded to disclosure.