Is CVE-2026-52192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52192 being exploited in the wild.

How severe is CVE-2026-52192?

Informational severity, with a CVSS score of 9.8, published 2 July 2026.

Which products and versions are affected?

UTT NV518G nv518GV3v3.2.7-210919-161313.

Is there a fix for CVE-2026-52192?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52192 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52192?

Check whether you run UTT NV518G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52192: UTT nv518G command injection in gohead/sub_445C5C

CVE-2026-52192 · Severity: info · CVSS 9.8 · Published 2026-07-02

A vulnerability exists in the UTT nv518G enterprise router that allows an attacker to take complete control of the device. By sending a specially crafted network request, a remote attacker can bypass security controls to execute system commands. This could lead to the theft of sensitive data, interception of network traffic, or a total shutdown of the router's services.

Technologies: UTT NV518G. Vendors: UTT.

Quick answers

Is CVE-2026-52192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52192 being exploited in the wild.
How severe is CVE-2026-52192?: Informational severity, with a CVSS score of 9.8, published 2 July 2026.
Which products and versions are affected?: UTT NV518G nv518GV3v3.2.7-210919-161313.
Is there a fix for CVE-2026-52192?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52192 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52192?: Check whether you run UTT NV518G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in the UTT nv518G router (firmware version nv518GV3v3.2.7-210919-161313) within the gohead/sub_445C5C component. The root cause is the unsafe use of the sprintf function to construct a system command string using the 'serialNo' parameter without proper sanitization. Specifically, the code executes 'rm -f %s%s.xml' via doSystem(), where the second format string is populated by user-controlled input. An attacker can use shell metacharacters (e.g., ';', '|', or '$()') to break out of the intended command and execute arbitrary code with system privileges. While the initial advisory mentions Denial of Service, the technical analysis confirms full remote code execution (RCE).

Affected products

UTT nv518G nv518GV3v3.2.7-210919-161313

Timeline

2026-07-02: disclosed: Initial disclosure via NVD and GitHub report

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.