A remote command execution vulnerability exists in the /goform/formReleaseConnect component of the UTT Aggressive 520W. The flaw allows an attacker to inject a crafted string that is executed with the privileges of the device, enabling arbitrary system commands. This is a classic command injection weakness (CWE‑78) that would compromise confidentiality, integrity, and availability of the device and any systems it controls.

The affected device is the UTT Aggressive 520W, version v3v1.7.7‑180627. No other vendor or product variants are listed, so this specific firmware release is the only known target.

The vulnerability is high impact because it grants full remote control of the device. No CVSS score or EPSS value is available, but the very nature of a remote code execution exploit indicates a high likelihood of exploitation if the device is exposed to untrusted networks. Attacks would be carried out by sending an HTTP request to the /goform/formReleaseConnect endpoint with a malicious payload. Because the device is a network appliance, there is a real possibility that it could be accessed by attackers on the local or remote network, making remediation urgent. The device does not appear on CISA's Known Exploited Vulnerabilities catalog, but the lack of a patch or workaround further increases the risk.