# CVE-2026-52186: UTT nv518G SQL injection in gohead/sub_463bbc

Source: https://junglewise.ai/threats/cve-2026-52186-utt-nv518g-sql-injection-in-gohead-sub-463bbc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-52186 · Severity: info · CVSS 9.8 · Published 2026-07-01

A security vulnerability exists in UTT nv518G enterprise routers. An attacker can send a specially crafted web request to the device to manipulate its internal database. This can lead to full control over the router, potentially allowing the attacker to intercept network traffic, disrupt internet connectivity, or access sensitive configuration data.

Technologies: [UTT NV518G](https://junglewise.ai/threats/technologies/nv518g). Vendors: [UTT](https://junglewise.ai/threats/vendors/utt).

## Quick answers

**Is CVE-2026-52186 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52186 being exploited in the wild.

**How severe is CVE-2026-52186?** Informational severity, with a CVSS score of 9.8, published 1 July 2026.

**Which products and versions are affected?** UTT NV518G nv518GV3v3.2.7-210919-161313.

**Is there a fix for CVE-2026-52186?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52186 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52186?** Check whether you run UTT NV518G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the UTT nv518G router firmware version nv518GV3v3.2.7-210919-161313. The vulnerability is located in the 'gohead/sub_463bbc' component, specifically within the handling of the 'delsn' POST parameter. The application uses 'strtok_r' to process the input and subsequently passes the unsanitized data into a 'sprintf' function to construct a SQL query. A remote, unauthenticated attacker can exploit this by sending a crafted 'delsn' value (e.g., using boolean-based injection or stacked queries) to manipulate database logic or achieve remote code execution.

## Affected products

- UTT nv518G nv518GV3v3.2.7-210919-161313

## Timeline

- 2026-07-01: disclosed: CVE published to NVD dataset

## References

- [https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00463bbc/README.md](https://github.com/akuma-QAQ/CVEreport/blob/main/518G/FUN_00463bbc/README.md)
- [https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn](https://utt.com.cn/downloadcenter.php?filetypeid=3&model=518G&lang=zhcn)

## Related threats

- [UTT nv518G command injection in gohead/sub_445C5C](https://junglewise.ai/threats/cve-2026-52192-utt-nv518g-command-injection-in-gohead-sub-445c5c)
- [UTT nv518G Buffer Overflow in gohead/sub_444C8C](https://junglewise.ai/threats/cve-2026-52191-utt-nv518g-buffer-overflow-in-gohead-sub-444c8c)
- [UTT nv518G buffer overflow in gohead/sub_487330](https://junglewise.ai/threats/cve-2026-52189-utt-nv518g-buffer-overflow-in-gohead-sub-487330)
- [UTT nv518G buffer overflow in gohead component](https://junglewise.ai/threats/cve-2026-52188-utt-nv518g-buffer-overflow-in-gohead-component)
- [UTT nv518G buffer overflow in GoAhead sub_483ba0](https://junglewise.ai/threats/cve-2026-52187-utt-nv518g-buffer-overflow-in-goahead-sub-483ba0)