CVE-2026-2847: UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injection
Published Feb 20, 2026
·Updated
A vulnerability was detected in UTT HiPER 520 1.7.7-160105. Affected is the function sub44EFB4 of the file /goform/formReleaseConnect of the component Web Management Interface. The manipulation of the argument IspName results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.
Affected Software
3 affected components
UTT HiPER 520
All of the following
UTT 520 Firmware=1.7.7-160105
UTT 520=3.0
Event History
Feb 20, 2026
CVE Published
via MITRE·03:32 PM
Data Sourced
via MITRE·03:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:22 PM
DescriptionSeverityWeaknessAffected Software
Jan 24, 58126
Event
via FIRST·02:44 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-2847?
CVE-2026-2847 has a high severity due to its potential for remote command injection.
2
How do I fix CVE-2026-2847?
To fix CVE-2026-2847, update the UTT HiPER 520 firmware to the latest version that addresses this vulnerability.
3
What is the exploit type for CVE-2026-2847?
CVE-2026-2847 is classified as an OS command injection vulnerability.
4
Can CVE-2026-2847 be exploited remotely?
Yes, CVE-2026-2847 can be exploited remotely by manipulating the Isp_Name argument.
5
Which component is affected by CVE-2026-2847?
CVE-2026-2847 affects the Web Management Interface of UTT HiPER 520.