External risk intelligence

UTT nv518G nv518GV3v3.2.7-210919-161313 SQL Injection Vulnerability In gohead/sub_463bbc Component

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-52186

The affected product is a router/gateway device. Such networking appliances are designed to be deployed at the network edge to manage internet connectivity, making their management interfaces or web-based control components commonly reachable via the public internet.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a remote code execution flaw in a network device. The issue allows an unauthenticated attacker to potentially compromise the device's security and operations.

Unauthenticated attackers can execute code remotely.
This could impact network device integrity and operations.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request over the network to a router running vulnerable software. This request would target the `gohead/sub_463bbc` component, which is susceptible to SQL injection. Successful exploitation could allow the attacker to execute arbitrary code on the affected device.

No special access needed.
SQL injection in a web component.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this SQL injection vulnerability to execute arbitrary code on affected devices. This could lead to a compromise of the device's integrity and potentially affect its normal operation.

Device integrity could be compromised.
Arbitrary code execution via network.
Device malfunction or unauthorized control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in UTT nv518G devices requires action from teams responsible for network edge devices and application security. The first step is to identify all instances of the affected technology, confirm their network exposure and business criticality, and then assign ownership for remediation planning.

Identify accountable asset owners.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the UTT nv518G device?

The UTT nv518G is a network gateway or router device. These appliances are typically deployed at the perimeter of a network to manage traffic flow, provide internet connectivity, and handle routing functions for business or home environments.

What does CVE-2026-52186 mean in plain English?

This vulnerability is classified as a SQL Injection (CWE-89). It means a specific part of the device's web management interface fails to properly sanitize input. An attacker can use this flaw to send malicious database commands, which allows them to bypass security controls and run arbitrary code on the underlying device.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted request to the 'gohead/sub_463bbc' component on the device. Because the vulnerability exists in a web-based component, it does not require the attacker to have pre-existing credentials or special user access to the router to launch the attack.

Is my device at risk if it is not on the internet?

Halo Surface Signal identifies this as an external-facing risk because routers like the UTT nv518G are often placed at the network edge to manage internet traffic, making their management interfaces inherently reachable from the public internet. If your device is strictly isolated from the internet and only accessible via a secure internal management network, the practical risk is significantly reduced.

What should I do if I use this router?

Begin by creating an inventory of all UTT nv518G units within your infrastructure to confirm which are deployed. Assess their current connectivity and importance to your operations. Once identified, establish clear ownership for these devices so you can monitor for official vendor updates or security patches to remediate the vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.