PT-2026-7021

CVE-2026-2188

Published

2026-01-31

Updated

2026-02-09

Description by

CVSS 2.0

9.0

High

MetricsAV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UTT 进取 521G version 3.1.1-190816

Description A flaw exists in the function sub 446B18 located in the file /goform/formPdbUpConfig. Manipulation of the policyNames argument can result in operating system command injection. This issue is potentially exploitable remotely. The exploit has been publicly disclosed.

Recommendations Apply mitigations to prevent manipulation of the policyNames argument in the sub 446B18 function of the /goform/formPdbUpConfig file.

Exploitability

Exploit

Fix

Impacts

Researchers

Cha0Yang

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers