A critical OS command injection vulnerability in the UTT HiPER 520 router allows remote attackers with administrative privileges to execute arbitrary system commands.

This flaw is an OS command injection vulnerability (CWE-78) located in the /goform/formReleaseConnect endpoint. The vulnerability is triggered by manipulating the Isp_Name argument, allowing an authenticated administrator to execute arbitrary commands on the underlying operating system.

The ability to execute arbitrary OS commands poses a severe risk to the integrity and availability of the affected network infrastructure. Successful exploitation could lead to full system compromise, unauthorized access to sensitive network traffic, or the deployment of persistent backdoors, justifying its high CVSS score of 7.2.

Immediate Action: Since no official patch is currently available, restrict access to the web management interface to trusted administrative IP addresses only.

Proactive Monitoring: Review web access logs for suspicious requests directed at the /goform/formReleaseConnect endpoint, particularly those containing shell metacharacters in the Isp_Name parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing malicious command injection patterns targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record (https://github.com/cha0yang1/UTT520CVE/blob/main/UTTRCE2.md).

Given the availability of a public exploit and the high severity of OS command injection, immediate action is required to mitigate this risk. Administrators should isolate the device management interface from untrusted networks and monitor for unauthorized configuration changes until a vendor-supplied firmware update is released.