CVE-2026-52186: SQL Injection vulnerability in UTT nv518G nv518GV3v3

Synopsis

SQL injection vulnerability in UTT nv518G (firmware version nv518GV3v3.2.7-210919-161313) allows a remote, unauthenticated attacker to inject malicious SQL statements through the gohead/sub_463bbc component. The device is reachable over the network and requires no authentication or user interaction to exploit. Successful exploitation gives an attacker arbitrary code execution on the device. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the device's HTTP service from a remote network location.

• AuthenticationNot required

  No credentials or prior account access are needed; the injection endpoint is reachable by any unauthenticated caller.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user on the targeted device.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• Attacker reads all data stored in the device database, which may include credentials, session tokens, and network configuration.
• Attacker modifies or deletes persisted configuration records, altering firewall rules, routing tables, or user account data.
• Attacker achieves arbitrary code execution on the device firmware, gaining full control of the underlying system.
• Attacker can crash or destabilize the device service, causing a loss of network connectivity for downstream users.