CVE-2026-2080
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on UTT HiPER 810 routers by injecting malicious input into the password parameter of the setSysAdm function. Attackers can gain full control of affected devices without authentication. All users running the vulnerable firmware version are at risk.
💻 Affected Systems
- UTT HiPER 810
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router leading to network takeover, data interception, lateral movement to internal systems, and persistent backdoor installation.
Likely Case
Router compromise allowing traffic monitoring, credential theft, and use as a pivot point for internal network attacks.
If Mitigated
Limited impact if device is behind firewall with strict inbound rules, though internal attacks remain possible.
🎯 Exploit Status
Public exploit code exists in GitHub repository. Remote exploitation requires no authentication. Simple command injection via password parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor did not respond to disclosure. Consider workarounds or replacement.
🔧 Temporary Workarounds
Network Segmentation
allIsolate HiPER 810 routers in separate VLAN with strict access controls
Access Restriction
linuxBlock external access to router management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_networks -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Implement strict network monitoring for unusual router traffic or configuration changes
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at System > System Info. If version is 1.7.4-141218, device is vulnerable.Check Version:
curl -s http://router-ip/goform/getSysInfo | grep versionVerify Fix Applied:
No fix available to verify. Consider verifying workarounds by testing external access to port 80/443.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formUser with shell metacharacters in parameters
- System log entries showing unexpected command execution
Network Indicators:
- Outbound connections from router to unusual destinations
- Sudden changes in router configuration
SIEM Query:
source="router_logs" AND uri="/goform/formUser" AND (param="passwd1" AND value MATCHES "[;&|`$()]+")