CVE-2026-2080

high · 7.3

A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

7.3

CVSS

10.8%

EPSS (exploit prob.)

96th

EPSS percentile

2026-02-07

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
utt	810_firmware	1.7.4-141218
utt	810	4.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/cha0yang1/UTT810CVE/blob/main/README.md
https://github.com/cha0yang1/UTT810CVE/blob/main/README.md#reproduction-steps
https://vuldb.com/?ctiid.344646
https://vuldb.com/?id.344646
https://vuldb.com/?submit.745521

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-2080