CVE-2026-2846

UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.17.2High EPSS percentile95th8.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2026-02-20Updated 2026-02-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

UTT HiPER 520Affected: 1.7.7-160105Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run a UTT HiPER 520 and whether its firmware is version 1.7.7-160105.
Restrict the router’s management page to trusted internal administrator devices; do not expose it directly to the internet.
No fixed firmware version has been published; ask UTT or your reseller for an official security update for CVE-2026-2846.
Change management passwords, remove unused administrator accounts, and review recent router configuration changes.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

In plain language

Written by AI from the record

UTT HiPER 520 firmware version 1.7.7-160105 has a serious flaw that can let a logged-in attacker take over the router, so affected businesses should act soon.

Authenticated remote OS command injection in the UTT HiPER 520 Web Management Interface through the policyNames argument in formPdbUpConfig.

If you're affected

Router takeover
Network disruption
Traffic interception
Configuration tampering
Ransomware staging

What is it

This is a defect in the router’s administration page that can let someone with access send instructions the router should never accept. It is like a building manager’s control panel accepting a malicious command that gives the visitor control of the whole building.

Who is affected

This matters to you if you use or run a UTT HiPER 520 router. The issue requires an attacker to have a management login and is most concerning when the management page can be reached from the internet.

How urgent is it

Public proof-of-concept instructions are available, making this a meaningful risk for exposed devices or compromised administrator accounts. Treat this as an amber priority: reduce access now and obtain an official update as soon as one is available.

What to do — in detail

Confirm the model and installed firmware in the UTT HiPER 520 administration interface or through your managed service provider. Verify whether the Web Management Interface is reachable from the internet, including through port forwarding, remote-management settings, VPN bypasses, or cloud-managed access.

No vendor fixed version, supported branch, or upgrade path is available in the findings. Do not install unverified third-party firmware. If patching is delayed, disable external management access, limit administration to a management network or VPN, allow only named administrator devices where possible, and use unique strong administrator passwords.

Review router logs and configuration history for unexpected administrator logins, new accounts, changed DNS settings, firewall or port-forwarding changes, and unfamiliar scheduled tasks or network rules. There is no CISA KEV due date because this CVE is not listed in CISA KEV.

Technical context

CVSS 3.1: 7.2 High (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The weakness is CWE-77/CWE-78 OS command injection in the Web Management Interface’s formPdbUpConfig endpoint, involving the policyNames argument and sub_44D264. Remote exploitation is possible after authentication; no user interaction is required. A public GitHub PoC is known, but the findings do not confirm in-the-wild exploitation. EPSS is 10.2% (95th percentile) and rising. The CVE is not listed in CISA KEV.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

8.4% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 222 days, from the signal feeds we watch.

2026-09-30EPSS band changemoderate → low
2026-09-24EPSS band changemoderate → lowepss band change
2026-09-21EPSS band changelow → moderate
2026-09-19EPSS band changelow → moderateepss band change
2026-03-07Public exploit / PoCsource: github-poc
2026-02-24Record updated

Affected products

UTTcommercial
- 520 firmwareNetworking Infrastructure
- HiPER 520Networking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable