CVE-2026-52189: UTT nv518G Buffer Overflow Denial of Service Vulnerability

Technical summary

CVE-2026-52189 is a classic buffer overflow condition (CWE-120) in the gohead/sub_487330 component of UTT nv518G firmware. The vulnerability permits an unauthenticated remote attacker to send a specially crafted request over the network that causes improper memory handling, resulting in application crash or potential service interruption. The lack of access controls (PR:N) and user interaction requirements (UI:N) means exploitation can occur from any network vantage point without authentication.

Business impact

Organizations using UTT nv518G devices face potential service disruption if this vulnerability is exploited. Repeated or sustained attacks could impact network operations, monitoring capabilities, or whatever role the nv518G performs in the environment. While the vulnerability does not permit data theft or system takeover, the denial-of-service risk necessitates prompt remediation to maintain uptime and operational resilience.

Affected systems

UTT nv518G devices running firmware version nv518GV3v3.2.7-210919-161313 are confirmed vulnerable. Organizations should inventory their nv518G deployments and verify the exact firmware version in use. Affected devices should be treated as high priority for patching once updates become available from UTT.

Exploitability

This vulnerability has a network-based attack vector with no authentication or user interaction required, making it straightforward to exploit. However, it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting that active exploitation in the wild has not yet been widely documented. Organizations should nevertheless treat this as exploitable and prioritize defensive measures accordingly.

Remediation

Contact UTT to obtain a patched firmware version for the nv518G. Apply updates in a controlled maintenance window to minimize service impact. Verify that the new firmware version is greater than nv518GV3v3.2.7-210919-161313. If patches are not immediately available, consider temporary network segmentation to limit attacker access to the device.

Patch guidance

Verify against the UTT vendor advisory for the specific patched firmware version and availability timeline. Once available, schedule an update during maintenance to avoid service interruption. Confirm the updated version in device settings post-deployment. If your nv518G version differs from the confirmed vulnerable version, verify your actual firmware against UTT's vulnerability statement to confirm whether your deployment is affected.

Detection guidance

Monitor network logs for unusual connection attempts to nv518G devices, particularly patterns indicating buffer overflow probes or malformed requests to the gohead component. Check device logs for unexpected crashes or restarts. Endpoint detection and response tools should flag attempts to send oversized payloads to the device. Network segmentation can help isolate affected devices and reduce exposure.

Why prioritize this

The HIGH CVSS score (7.5) reflects the combination of network accessibility, lack of authentication requirements, and guaranteed availability impact. Although not yet in active widespread exploitation, the straightforward attack surface and denial-of-service impact warrant prompt remediation. Prioritize patching based on the criticality of the nv518G in your infrastructure and the potential business impact of its unavailability.

Risk score, explained

The CVSS 3.1 score of 7.5 is driven by: (1) Network attack vector—no physical access required; (2) Low complexity—no special conditions to trigger the flaw; (3) No authentication—any remote attacker can attempt exploitation; (4) No user interaction—automatic triggering upon receipt of malicious input; (5) Confidentiality and integrity unaffected, but availability severely compromised. This rating places the vulnerability in the HIGH severity band, reflecting substantial risk that justifies rapid response.

Frequently asked questions