Vulnerability · Published Feb 20, 2026 · Assigned by VulDB
CVE-2026-2847UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection
High 7.2
In plain English
A high-severity OS command injection in HiPER 520 from UTT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.5% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)10.5%top 4.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub_44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument Isp_Name results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected products (as reported)
Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-347083 | UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection vdb-entry, technical-description
- VDB-347083 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #753965 | UTT HiPER 520 nv520v3v1.7.7-160105 Command Injection third-party-advisory
- https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE2.md exploit