The UTT HiPER 810 router is affected by a critical command injection vulnerability that could allow remote attackers to execute arbitrary system commands with administrative privileges.

This vulnerability, identified as a command injection (CWE-77), exists within the sub_4407D4 function of the /goform/formReleaseConnect endpoint. The flaw allows an authenticated attacker with administrative privileges to manipulate the Isp_Name argument to inject and execute malicious system commands remotely.

Successful exploitation grants an attacker the ability to execute unauthorized commands on the affected router, potentially leading to a complete compromise of the device. Given the CVSS score of 7.2, this represents a significant risk to network integrity: an attacker could pivot to internal systems, intercept traffic, or cause persistent denial of service, resulting in severe operational disruption.

Immediate Action: Since no official patch is currently confirmed, administrators should restrict management interface access to trusted internal IP addresses only.

Proactive Monitoring: Monitor firewall and web server logs for suspicious activity targeting the /goform/formReleaseConnect endpoint, specifically looking for unconventional character sequences in the Isp_Name parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing command injection patterns in the Isp_Name field.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at GitHub.

Due to the availability of a public proof-of-concept and the high impact of command injection, this vulnerability poses a credible threat. Administrators are advised to isolate the management interface of the UTT HiPER 810 immediately and monitor for vendor updates, applying them as soon as they become available to remediate this flaw.