CVE-2026-2080

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208006.5Gitea's notification API does not re-validate repository access permissions when returning notification details. After a user's access to a CVE-2026-208015.6Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integr CVE-2026-208037.2Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.CVE-2026-208047.7Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.CVE-2026-208055.5Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information CVE-2026-208065.5Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.CVE-2026-208087.0Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authoriz CVE-2026-208097.8Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.CVE-2026-20817.2A vulnerability was determined in D-Link DIR-823X 250416. The affected element is an unknown function of the file /goform/set_password. This CVE-2026-208107.8Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-208117.8Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges CVE-2026-208126.5Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a