CVE-2026-2118

🗓️ 08 Feb 2026 00:02:07Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 57 Views🌐 WEB

CVE-2026-2118 enables remote command injection in HiPER 810 via Isp_Name in rehttpd formReleaseConnect.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-2118	8 Feb 202600:02	–	attackerkb
CNNVD	UTT HiPER 810 command injection vulnerability	8 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2118 UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection	8 Feb 202600:02	–	cvelist
EUVD	EUVD-2026-5827	8 Feb 202600:02	–	euvd
NVD	CVE-2026-2118	8 Feb 202601:16	–	nvd
osv_cve	CVE-2026-2118	8 Feb 202601:16	–	osv_cve
Positive Technologies	PT-2026-6938	8 Feb 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-2118: Improper Neutralization of Special Elements used in a Command	8 Feb 202600:00	–	rapid7
RedhatCVE	CVE-2026-2118	9 Feb 202601:33	–	redhatcve
Vulnrichment	CVE-2026-2118 UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection	8 Feb 202600:02	–	vulnrichment

NVD

Node

AND

utt 810_firmwareMatch1.7.4-141218

utt 810Match4.0

[
  {
    "vendor": "UTT",
    "product": "HiPER 810",
    "versions": [
      {
        "version": "1.7.4-141218",
        "status": "affected"
      }
    ],
    "modules": [
      "rehttpd"
    ]
  }
]

Source	Link
github	www.github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme1.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
Isp_Name	request body	/goform/formReleaseConnect	Command injection vulnerability in the sub_4407D4 function of the rehttpd component via manipulation of the Isp_Name argument.	CWE-74, CWE-77

17 Jun 2026 10:30Current

7High risk

Vulners AI Score7

CVSS 3.17.2

CVSS 37.2

CVSS 28.3

CVSS 48.6

EPSS0.04914

SSVC