The flaw is in the HiPER 810 firmware’s /goform/formPdbUpConfig handler, where the policyNames argument is passed directly to a shell command. An attacker can supply crafted data that injects arbitrary commands, giving the attacker execution privileges on the device. The vulnerability is flagged as CWE‑74 and CWE‑77, indicating unsanitized command execution and insufficient input validation.

Only the UTT HiPER 810 device running firmware 1.7.4‑141218 is listed as affected; no other versions are mentioned, so the impact is confined to that specific build.

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of less than 1 % reflects a low probability of exploitation today. The vulnerability is not in the CISA KEV catalog, yet a public exploit exists, and the description states the attack can be launched remotely without prior authentication. Consequently, an attacker with network reach to the device could execute arbitrary commands quickly and without complex prerequisites.