CVE-2026-52188: Buffer Overflow in UTT nv518G Firmware – Medium Severity DoS Vulnerability

Technical summary

CVE-2026-52188 is a CWE-119 stack/heap buffer overflow vulnerability affecting the gohead HTTP daemon component in UTT nv518G devices. The flaw exists in the sub_497498 function and permits unauthenticated, network-adjacent attackers to craft input that exceeds buffer boundaries, leading to memory corruption and process termination. The vulnerability requires network access (AV:A) and can be exploited with no user interaction (UI:N). The attack surface is the local network segment, as indicated by the CVSS vector requiring adjacent network proximity.

Business impact

Organizations deploying UTT nv518G devices in their network infrastructure face availability risks. A successful exploitation results in denial of service, potentially disrupting services hosted or proxied through the affected device. While confidentiality and integrity are not compromised, the availability impact is high, making this a concern for production deployments where device uptime is critical. The impact is limited to the compromised device itself (Scope:Unchanged) rather than affecting wider systems.

Affected systems

UTT nv518G devices running firmware version nv518GV3v3.2.7-210919-161313 are affected. Organizations should verify whether this specific firmware version is deployed in their network. The vulnerability's network-adjacent nature means it poses risk primarily to devices accessible from internal networks or DMZ environments. Verify your device inventory against this exact firmware build identifier and assess exposure based on network segmentation and access controls.

Exploitability

This vulnerability has a moderate barrier to exploitation. While no KEV (Known Exploited Vulnerability) status has been assigned and no public exploits are currently tracked, the attack vector is adjacent network (internal network or physically nearby wireless), not direct internet-facing attack. Attack complexity is low, meaning a functional exploit would not require sophisticated techniques. However, the attacker must have some degree of network access to the device. The absence of KEV status suggests limited real-world exploitation activity to date.

Remediation

Apply available firmware updates from UTT for the nv518G device. Consult the vendor's advisory to identify patched firmware versions that address this buffer overflow. Until patches are available or applied, restrict network access to the affected devices using firewall rules and network segmentation. Limit administrative and operational access to the gohead HTTP service, and consider deploying the device on isolated network segments if high availability is critical.

Patch guidance

Check the UTT vendor advisory or support portal for nv518G firmware updates released after July 2, 2026 (the publication date of this CVE). Download and apply the patched firmware version according to UTT's documented procedures. Test the update in a non-production environment first to ensure compatibility with your deployment. Verify the firmware version after patching matches the recommended secure version from the vendor guidance.

Detection guidance

Monitor network traffic to and from nv518G devices for abnormal HTTP requests to the gohead service component, particularly payloads that appear designed to test buffer limits or inject oversized headers. Observe device logs and system stability metrics for unexpected crashes or service restarts of the gohead daemon. Network intrusion detection systems (IDS) can be configured to alert on suspicious HTTP traffic patterns targeting known vulnerable firmware versions. Device-side logging should capture any access attempts to the sub_497498 function path if available.

Why prioritize this

While the CVSS 3.1 score of 6.5 (Medium) reflects the availability-only impact and required network adjacency, prioritization depends on your infrastructure. This should be prioritized if you operate nv518G devices in environments where denial of service has significant business impact, or where network segmentation is limited. The lack of KEV status and current exploit activity suggests this is not an immediate emergency, but it warrants prompt remediation planning, particularly if the affected firmware version is in use.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating based on: (1) Attack Vector: Adjacent Network—the attacker must be on the local network segment, (2) Attack Complexity: Low—no special conditions required beyond network access, (3) Privileges Required: None—no authentication needed, (4) User Interaction: None—exploitation occurs without user action, (5) Scope: Unchanged—impact is limited to the vulnerable device, and (6) Availability Impact: High—the device becomes unavailable. The absence of Confidentiality and Integrity impact caps the severity. The adjacent network requirement is the primary limiting factor preventing a higher score.

Frequently asked questions