CVE-2026-2188

🗓️ 08 Feb 2026 21:32:06Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 17 Views🌐 WEB

UTT 521G 3.1.1-190816 OS command injection via sub_446B18 in formPdbUpConfig by policyNames.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-2188	8 Feb 202621:32	–	attackerkb
BDU FSTEC	The vulnerability of the sub_446B18 function in the /goform/formPdbUpConfig file of the UTT 521G router’s microprogramming software, which allows a hacker to execute arbitrary commands.	4 Mar 202600:00	–	bdu_fstec
CNNVD	UTT 521G 操作系统命令注入漏洞	8 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2188 UTT 进取 521G formPdbUpConfig sub_446B18 os command injection	8 Feb 202621:32	–	cvelist
EUVD	EUVD-2026-5762	8 Feb 202621:32	–	euvd
NVD	CVE-2026-2188	8 Feb 202622:15	–	nvd
OSV	CVE-2026-2188	8 Feb 202622:15	–	osv
Positive Technologies	PT-2026-7021	8 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2188	10 Feb 202601:23	–	redhatcve
Vulnrichment	CVE-2026-2188 UTT 进取 521G formPdbUpConfig sub_446B18 os command injection	8 Feb 202621:32	–	vulnrichment

NVD

Vulners

Node

utt 521g_firmwareMatch3.1.1-190816

AND

utt 521gMatch2.0

[
  {
    "vendor": "UTT",
    "product": "进取 521G",
    "versions": [
      {
        "version": "3.1.1-190816",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/cha0yang1/UTT521G/blob/main/RCE2.md

Parameter	Position	Path	Description	CWE
policyNames	request body	goform/formPdbUpConfig	OS command injection via manipulated policyNames parameter in formPdbUpConfig	CWE-77, CWE-78

17 Jun 2026 10:30Current

7High risk

Vulners AI Score7

CVSS 3.17.2

CVSS 28.3

CVSS 48.6

CVSS 37.2

EPSS0.06413

SSVC