This vulnerability resides in the /goform/formDia component of UTT Aggressive HiPER 520W and allows an attacker to send a specially crafted string that causes the device to execute arbitrary operating‑system commands. The impact is therefore pronounced: an attacker who succeeds can compromise confidentiality, integrity, and availability of the device and any systems connected to it. The weakness is a classic Command Injection flaw (CWE‑78).

Devices running UTT Aggressive HiPER 520W firmware version 3. v1.7.7-180627 are affected. No other versions are indicated as vulnerable in the current data, but the absence of further disclosure does not guarantee absence of similar issues in other releases.

The vulnerability is a high‑severity Remote Code Execution flaw that can be exploited remotely over the network using the device’s web interface. While the CVSS score and EPSS probability are not available, the nature of the flaw denotes high risk. The vulnerability is not listed in CISA’s KEV catalog, and the attack vector is inferred to be remote HTTP traffic to /goform/formDia.