CVE-2026-52187: Buffer Overflow DoS in UTT nv518G Firmware – Patch Now

Technical summary

CVE-2026-52187 is a classic buffer overflow (CWE-120) discovered in the gohead HTTP server daemon running on UTT nv518G equipment. The vulnerability resides in the sub_483ba0 function and can be triggered remotely without authentication, credentials, or user interaction. The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects network-adjacent attack complexity, complete lack of access controls, and high impact on availability. The absence of confidentiality and integrity impacts indicates the defect does not leak data or enable code execution in this context.

Business impact

A successful exploit causes the nv518G device to become unavailable, interrupting any services dependent on the affected equipment. For organizations deploying these devices in production environments—whether for network management, monitoring, or specialized network functions—repeated or sustained attacks could degrade operational resilience. The lack of authentication requirements means any network-connected attacker can trigger the condition, making this a network-wide concern rather than an insider threat.

Affected systems

UTT nv518G devices running firmware version nv518GV3v3.2.7-210919-161313 are confirmed vulnerable. Organizations should verify whether they operate this specific firmware build. UTT may have released patches or updated firmware versions since the vulnerability was published; verify the latest available firmware against UTT's official advisories to confirm patched status.

Exploitability

Exploitability is straightforward: no authentication, no special privileges, and no user interaction are required. Any attacker with network access to the device can craft a request to the gohead component that triggers the buffer overflow condition. The network-accessible attack vector and low complexity mean this vulnerability presents an elevated practical risk in environments where nv518G devices are directly reachable from untrusted networks or the internet.

Remediation

Immediately identify and inventory all UTT nv518G devices running the affected firmware. Contact UTT for available firmware updates or patches that address this buffer overflow. If patches are available, plan and execute a coordinated firmware upgrade across affected devices. Pending patching, isolate vulnerable devices behind network firewalls or access controls to restrict connectivity to authorized networks only.

Patch guidance

Check UTT's official support portal or advisories for available firmware updates. Apply any patches released for the nv518G line with priority, as the low barrier to exploitation makes delay inadvisable. Verify patch version numbers against UTT's published release notes before deployment. Test patches in a non-production environment first to ensure compatibility with your network configuration.

Detection guidance

Monitor network traffic to and from nv518G devices for abnormal HTTP requests or patterns targeting the gohead service, particularly requests with unusual payload sizes or malformed headers that could trigger buffer overflows. Alert on repeated failed connections or service restarts on affected devices. Implement network segmentation to limit direct external access to these devices, and log all inbound connections for forensic review if availability incidents occur.

Why prioritize this

Despite being outside the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits rapid remediation due to its high CVSS score, lack of authentication requirements, and direct impact on device availability. Organizations running these devices should treat this as a priority patch window, particularly if devices are externally reachable. The combination of ease of exploitation and operational impact justifies urgent action over a standard patch cycle.

Risk score, explained

The CVSS 7.5 (HIGH) rating reflects the network-adjacent attack vector, trivial complexity, and high availability impact. While confidentiality and integrity are not compromised, the ability for any remote attacker to disable the device without authentication or privileges creates substantial operational risk. Organizations relying on these devices for critical functions should consider the contextual severity higher if device availability directly affects business continuity.

Frequently asked questions