A crafted string sent to the /goform/formDia component of the UTT Aggressive HiPER 520W allows an attacker to execute arbitrary system commands, giving the attacker full control over the device. This classic command‑injection flaw (CWE‑77) can compromise confidentiality, integrity, and availability by enabling code execution, data exfiltration, and malicious configuration changes.

The vulnerability impacts the UTT Aggressive HiPER 520W hardware model 520W running firmware version 1.7.7‑180627. The affected firmware is identified by the supplied CPE strings and is based on the 3.0 platform variant.

With a CVSS score of 9.8 the flaw is rated critical. The EPSS score of less than 1% indicates a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP request to the exposed web interface; an attacker only needs to reach the device’s management port to exploit the flaw, after which arbitrary commands can be executed.