Vulnerability · Published Feb 8, 2026 · Assigned by VulDB
CVE-2026-2182UTT 进取 521G setSysAdm doSystem command injection
High 7.2
In plain English
A high-severity command injection in 进取 521G from UTT. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.6% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)9.6%top 4.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-344885 | UTT 进取 521G setSysAdm doSystem command injection vdb-entry, technical-description
- VDB-344885 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #749712 | UTT (艾泰) UTT521G NV521Gv2v3.1.1-190816 Command Injection third-party-advisory
- https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md related
- https://github.com/cha0yang1/UTT521G/blob/main/RCE1.md#poc exploit