PT-2026-6898

CVE-2026-2080

Published

2026-02-07

Updated

2026-02-13

Description by

CVSS 2.0

8.3

High

MetricsAV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218

Description A flaw exists in the setSysAdm function within the /goform/formUser file. Manipulating the passwd1 argument can lead to command injection. Remote exploitation is possible. The details of the exploit have been publicly disclosed. The vendor was informed of this disclosure but did not respond.

Recommendations Apply a fix for the vulnerability in the setSysAdm function within the /goform/formUser file. As a temporary workaround, restrict access to the setSysAdm function until a patch is available. Avoid using the passwd1 parameter in the /goform/formUser file until the issue is resolved.

Exploitability

Exploit

Fix

Impacts

Researchers

Cha0Yang

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers