PT-2026-6961

CVE-2026-2135

Published

2026-01-27

Updated

2026-02-13

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218

Description A flaw exists in UTT HiPER 810 that allows for remote command injection. The issue is located in the sub 43F020 function within the /goform/formPdbUpConfig file. Manipulation of the policyNames argument can lead to the execution of arbitrary commands. The exploit for this issue is publicly available.

Recommendations Versions prior to 1.7.4-141218 are not affected. As a mitigation, restrict access to the /goform/formPdbUpConfig file. Avoid using the policyNames argument in the affected API endpoint /goform/formPdbUpConfig until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Cha0Yang

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers

CVE-2026-2135