UTT Aggressive HiPER 520W Remote Command Execution Vulnerability

A remote command execution vulnerability has been identified in the UTT Aggressive HiPER 520W router, specifically in versions through v3v1.7.7-180627. The vulnerability resides in the /goform/formDia component, where attackers can execute arbitrary commands by sending a crafted string. The exploitation involves manipulating the 'dialstr' parameter to inject commands, which are then executed on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/formDia endpoint. Include a crafted 'dialstr' parameter with the desired command injection. The request must be authorized using Digest authentication with valid credentials.