A remote OS command injection vulnerability in the UTT HiPER 520 router poses a high risk of complete system compromise by authenticated attackers.

This flaw is an OS command injection vulnerability (CWE-78) located in the function sub_44D264 within the /goform/formPdbUpConfig endpoint of the Web Management Interface. The vulnerability allows an authenticated attacker with high privileges to execute arbitrary system commands via the policyNames argument.

Successful exploitation allows an attacker to execute arbitrary code on the affected device, potentially leading to a full takeover of the network appliance. Given the CVSS score of 7.2, this vulnerability represents a significant risk to network integrity and confidentiality. Compromise of such infrastructure can facilitate further lateral movement within the network or interception of sensitive traffic.

Immediate Action: Restrict access to the Web Management Interface to trusted internal IP addresses only, as no official vendor patch is currently confirmed.

Proactive Monitoring: Monitor system logs for unusual process execution or attempts to access the /goform/formPdbUpConfig endpoint, particularly those originating from unauthorized internal hosts.

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to inspect incoming HTTP requests for malicious command characters or unexpected payloads in the policyNames parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up on GitHub.

The presence of a public proof-of-concept combined with the critical nature of command injection makes this a high-priority issue for network administrators. Because a patch is not currently verified, immediate implementation of access control lists to limit management interface exposure is necessary to mitigate the risk of unauthorized command execution.