The vulnerability allows an attacker to inject arbitrary operating‑system commands through the passwd1 parameter of the doSystem function in the /goform/setSysAdm interface. This unsanitized input leads to execution of malicious commands, granting the attacker full control over the device’s operating system. The flaw falls under the Command‑Injection family (CWE‑74) and involves improper input handling (CWE‑77). Successful exploitation enables an attacker to read, modify, or delete sensitive configuration data and potentially disrupt device operation.

The affected product is the UTT 进取 521G series, specifically firmware 3.1.1‑190816 and earlier revisions that include the vulnerable doSystem implementation. Devices using the 2.0 hardware variant are listed in the CPE data, but the flaw is tied to the firmware version. No other vendors or product lines are indicated as impacted.

The CVSS score of 8.6 categorizes this flaw as high severity. With an EPSS of less than 1 %, exploitation is considered unlikely at the current time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is inferred to be remote, requiring network access to the setSysAdm endpoint, and the attacker must supply a crafted passwd1 value. Because the flaw directly invokes system commands, a single successful request can achieve complete system compromise.