CVE-2026-52195: UTT nv518G Buffer Overflow Remote DoS Vulnerability

Technical summary

CVE-2026-52195 is a CWE-120 classic buffer overflow in the gohead/sub_472f08 component of UTT nv518G firmware. The vulnerability permits an unauthenticated remote attacker to send specially crafted input that overflows a buffer, leading to application crash and service unavailability. The CVSS 3.1 score of 7.5 (HIGH) reflects the network-accessible attack vector, low complexity, and high availability impact, though confidentiality and integrity remain unaffected.

Business impact

Devices running vulnerable firmware versions can be rendered unavailable through remote denial-of-service attacks. For organizations relying on UTT nv518G equipment in production, successful exploitation could disrupt network operations, access, or video surveillance capabilities depending on deployment context. The attack requires no credentials or user interaction, making it a persistent threat until patching is completed.

Affected systems

UTT nv518G devices with firmware version nv518GV3v3.2.7-210919-161313 are confirmed affected. Organizations should audit their hardware inventory to identify instances of this firmware revision. The vulnerability may affect other firmware versions; check the UTT vendor advisory for the full affected version range and any newer versions that address this issue.

Exploitability

Exploitability is straightforward due to the network-accessible, unauthenticated attack surface (CVSS AV:N, PR:N, UI:N). Existing public information about the gohead component and buffer overflow techniques may lower the barrier to weaponization. However, this vulnerability is not currently listed in the CISA KEV catalog, indicating limited evidence of active, widespread exploitation at this time—though absence from KEV does not guarantee lack of threat.

Remediation

The primary remediation is to upgrade affected UTT nv518G devices to a patched firmware version. Consult the UTT security advisory for the specific patched version number and deployment instructions. Until patches are available or applied, consider isolating vulnerable devices from untrusted networks or implementing network-level access controls to restrict who can reach the affected service.

Patch guidance

Contact UTT for official firmware patches addressing CVE-2026-52195. Verify patch version numbers and compatibility with your specific hardware models before deployment. Test patches in a non-production environment to confirm functionality and that they do not introduce regressions. Establish a phased rollout plan for production devices to minimize service disruption.

Detection guidance

Monitor for abnormal restarts or crashes of UTT nv518G devices, particularly if correlated with unusual network traffic. Network-based detection may identify suspicious payloads targeting the gohead service port. Enable logging on affected devices to capture connection attempts and input anomalies. Consider threat-hunting for signs of exploitation if these devices face untrusted network exposure.

Why prioritize this

Although not yet exploited at scale (per KEV status), the combination of HIGH severity, zero authentication requirements, and remote network accessibility makes this a priority for rapid patching. Buffer overflow vulnerabilities in exposed network services pose persistent risk; early remediation limits the window during which attackers can weaponize this flaw.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability with significant impact potential. The attack vector is network-based, complexity is low, and no privileges or user interaction are needed—all factors that raise risk. The vulnerability achieves high availability impact through denial of service. Confidentiality and integrity are not compromised, preventing a critical rating, but the ease of exploitation and widespread accessibility of affected devices justify close attention.

Frequently asked questions