Manipulation of the passwd1 argument in the setSysAdm function of the UTT HiPER 810 firmware enables remote command injection. By sending a crafted /goform/formUser request, an attacker can execute arbitrary shell commands with the privileges of the device. This leads to full compromise of confidentiality, integrity, and availability of the system, as the affected firmware runs with root‑level privileges and has access to network and management resources. The weakness is a classic command injection flaw (CWE‑74) exacerbated by a lack of input sanitization (CWE‑77).

The vulnerability affects UTT HiPER 810 devices running firmware 1.7.4‑141218 and the associated GoForm format 4.0. Devices with identical model and firmware revision are susceptible. No other hardware or firmware versions are listed as impacted.

The CVSS score of 8.6 indicates a high severity. The EPSS score of less than 1 % denotes a very low probability of exploitation in the wild, likely due to the need for remote access to a specific internal endpoint. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require network connectivity to the device’s management interface; an attacker who can reach the /goform/formUser URI can inject payloads into the passwd1 field and trigger remote command execution. The attack surface is limited to devices with the vulnerable firmware and publicly exposed management endpoints.