A critical command injection vulnerability in UTT HiPER 810 firmware allows authenticated remote attackers to execute arbitrary system commands.

This flaw is a command injection vulnerability (CWE-77) triggered by improper input validation of the passwd1 argument in the /goform/formUser endpoint. Successful exploitation requires high-privileged access to the administrative interface.

The vulnerability carries a CVSS score of 7.2, indicating a high severity risk. Successful exploitation allows an attacker to gain full control over the affected networking device, potentially leading to unauthorized network traffic interception, internal network pivot, and permanent loss of confidentiality, integrity, and availability for the gateway.

Immediate Action: As there is currently no official patch from the vendor, isolate the administrative interface of all UTT HiPER 810 devices from the public internet immediately to prevent remote access.

Proactive Monitoring: Review system logs for unauthorized access to /goform/formUser and monitor for suspicious outbound traffic patterns originating from the device that may indicate command-and-control communication.

Compensating Controls: Implement strict access control lists (ACLs) to restrict access to the device management interface to known, trusted management IP addresses only.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Given the availability of public exploitation details and the lack of vendor response, this vulnerability poses a significant risk to network infrastructure. Administrators should prioritize restricting administrative access to the affected devices until a security update is provided or the hardware is decommissioned.