CVE-2026-52199: Generic OEM 4G LTE Router RCE Vulnerability

CVE-2026-52199 Overview

CVE-2026-52199 is a command injection vulnerability [CWE-77] affecting the Generic OEM UZ801_v2.1 4G LTE Router running firmware version V3.4.3. The flaw resides in the sbin/adbd component, which exposes the Android Debug Bridge daemon on the device. A remote, unauthenticated attacker can leverage this exposed service to execute arbitrary code on the router. The router is a widely rebranded LTE dongle, so downstream devices sold by multiple OEMs are likely affected.

Critical Impact
Remote attackers can execute arbitrary commands on affected 4G LTE routers without authentication, gaining full control of the device and any traffic routed through it.

Affected Products

Generic OEM UZ801_v2.1 4G LTE Router firmware V3.4.3
OEM-rebranded variants of the UZ801 hardware platform
Devices exposing the adbd service on network interfaces

Discovery Timeline

2026-07-17 - CVE-2026-52199 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-52199

Vulnerability Analysis

The vulnerability originates in the sbin/adbd binary shipped with the UZ801_v2.1 firmware. The Android Debug Bridge daemon (adbd) is intended for development and debugging on Android-based systems. On the affected router, adbd is compiled into the production firmware and listens for connections without enforcing authentication or authorization checks. An attacker who can reach the device over the network can connect to the daemon and issue shell commands directly to the underlying Linux system.

Because adbd typically runs with elevated privileges on embedded devices, successful exploitation yields a high-privilege shell. From this position, attackers can modify firmware, extract SIM credentials, pivot into the internal network, and intercept or manipulate mobile data traffic.

Root Cause

The root cause is an insecure design decision: shipping a debugging service (adbd) in production firmware without access controls. The daemon accepts commands that map directly to OS-level execution, which aligns with the CWE-77 classification for improper neutralization of special elements used in a command.

Attack Vector

Exploitation requires network reachability to the router's adbd listener. An attacker uses a standard adb connect <device_ip>:<port> operation followed by adb shell to obtain command execution. No credentials, user interaction, or prior foothold are required. Public proof-of-concept material is available in the GitHub PoC Repository.

Detection Methods for CVE-2026-52199

Indicators of Compromise

Inbound TCP connections to the default adbd port (5555) on router management or WAN interfaces
Unexpected shell processes spawned as descendants of the adbd process
New or modified files under /system, /data, or /sbin on the router filesystem
Outbound connections from the router to unknown hosts following adb sessions

Detection Strategies

Scan network segments for devices with TCP port 5555 open and banner-grabbing responses that identify adbd
Inspect router syslog and process telemetry for adbd invocations of /system/bin/sh or busybox
Correlate firmware version V3.4.3 inventory data against known-vulnerable device lists

Monitoring Recommendations

Alert on any successful TCP handshake to port 5555 originating from outside trusted management ranges
Baseline expected traffic patterns from LTE routers and flag deviations such as new outbound C2-like beacons
Track firmware version changes across managed router fleets to detect unauthorized modification

How to Mitigate CVE-2026-52199

Immediate Actions Required

Block inbound TCP port 5555 at upstream firewalls and ISP-side ACLs for all affected devices
Remove affected UZ801-based routers from directly reachable network segments until remediated
Audit device inventories for the UZ801_v2.1 hardware platform and firmware V3.4.3
Rotate any credentials, PSKs, or certificates handled by compromised routers

Patch Information

No vendor patch is currently referenced in the NVD entry for CVE-2026-52199. Because the device is distributed as a generic OEM platform, affected users should contact their reseller or OEM for firmware updates. In the absence of an official patch, disabling or removing the adbd binary from the firmware image is the only reliable remediation.

Workarounds

Place affected routers behind an upstream firewall that drops all traffic to port 5555
Restrict router management interfaces to isolated VLANs with strict ACLs
Where firmware access is available, disable or remove sbin/adbd and any init script that launches it
Replace affected hardware with vendor-supported LTE routers that do not expose debug daemons in production builds

bash

# Configuration example: block adbd exposure at the network edge
iptables -A INPUT -p tcp --dport 5555 -j DROP
iptables -A FORWARD -p tcp --dport 5555 -j DROP

# On the device (if shell access is available), disable adbd persistence
mount -o remount,rw /system
chmod 000 /sbin/adbd
# Remove or comment any init entries that respawn adbd