CVE-2026-2182 - UTT 进取 521G setSysAdm doSystem command injection

Back Back to CVE browser

HIGH

UTT 进取 521G setSysAdm doSystem command injection

Published Feb 8, 2026

8.6

HIGH

CVSS 4.0

EPSS 9.74%

Description

A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Vendor UTT Product 进取 521G Default
n/a
- Version
  3.1.1-190816
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

UTT

进取 521G

n/a

Version	Status	Constraints
3.1.1-190816	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-77

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5768
Advisory
https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md
relatedExploitThird Party Advisory
https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md#poc
exploit
https://vuldb.com/?ctiid.344885
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.344885
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.749712
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-5768		Advisory
https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md		relatedExploitThird Party Advisory
https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md#poc		exploit
https://vuldb.com/?ctiid.344885		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.344885		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.749712		third-party-advisoryThird Party AdvisoryVDB Entry