Utt 810 Firmware vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Utt 810 Firmware: 5 record(s), with affected versions and fixes.cpe:2.3:o:utt:810_firmware
CVE-2025-70998
Critical · 9.8
CWE-1188 Feb 18, 2026
Insecure Default Initialization of Resource in Utt 810 Firmware
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script.
CVE-2026-2135
High · 8.8
CWE-74 Feb 8, 2026
UTT HiPER 810 formPdbUpConfig sub_43F020 command injection
A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Performing a manipulation of the argument policyNames results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
CVE-2026-2118
High · 7.2
CWE-74 Feb 7, 2026
UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection
A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-2080
High · 7.2
CWE-74 Feb 7, 2026
UTT HiPER 810 formUser setSysAdm command injection
A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-1162
Critical · 9.8
CWE-119 Jan 19, 2026
UTT HiPER 810 setSysAdm strcpy buffer overflow
A flaw has been found in UTT HiPER 810 1.7.4-141218. The impacted element is the function strcpy of the file /goform/setSysAdm. This manipulation of the argument passwd1 causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.