Vulnerability · Published Feb 20, 2026 · Assigned by VulDB

CVE-2026-2846UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection

High 7.2

In plain English

A high-severity OS command injection in HiPER 520 from UTT. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 11.0% (higher than 96% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)11.0%top 4.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105. This impacts the function sub_44D264 of the file /goform/formPdbUpConfig of the component Web Management Interface. The manipulation of the argument policyNames leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Affected products (as reported)

Vendor	Product	Versions
UTT	HiPER 520	1.7.7-160105

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-347082 | UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injection vdb-entry, technical-description
VDB-347082 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #753964 | UTT HiPER 520 nv520v3v1.7.7-160105 Command Injection third-party-advisory
https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE1.md exploit