CVE-2026-2118
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on UTT HiPER 810 routers by injecting malicious input into the Isp_Name parameter. Attackers can gain full control of affected devices without authentication. Organizations using UTT HiPER 810 routers with vulnerable firmware are at risk.
💻 Affected Systems
- UTT HiPER 810
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router leading to network interception, credential theft, lateral movement to internal systems, and persistent backdoor installation.
Likely Case
Router takeover enabling traffic monitoring, DNS manipulation, and use as attack platform against internal network.
If Mitigated
Limited impact if router is isolated with strict network segmentation and command injection attempts are blocked.
🎯 Exploit Status
Public proof-of-concept available on GitHub. Simple HTTP request with command injection payload required. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates. If unavailable, implement workarounds or replace hardware.
🔧 Temporary Workarounds
Disable rehttpd service
linuxDisable the vulnerable HTTP service component if not required for operations
ssh admin@router-ip
systemctl stop rehttpd
systemctl disable rehttpd
Network ACL blocking
linuxBlock external access to router management interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate router in separate VLAN with strict firewall rules limiting inbound/outbound traffic
- Implement network-based IPS/IDS to detect and block command injection attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface (System Status > Version) or SSH command: cat /etc/versionCheck Version:
cat /etc/version | grep '1.7.4-141218'Verify Fix Applied:
Test with proof-of-concept payload to confirm command injection no longer works📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/formReleaseConnect with unusual Isp_Name parameters
- System logs showing unexpected command execution
Network Indicators:
- HTTP POST requests containing shell metacharacters (;, |, &, $, `) in Isp_Name parameter
SIEM Query:
source="router-logs" AND uri="/goform/formReleaseConnect" AND (Isp_Name="*;*" OR Isp_Name="*|*" OR Isp_Name="*`*")