CVE-2026-52200 Overview
CVE-2026-52200 is a remote code execution vulnerability affecting the Generic OEM UZ801_v2.1 4G LTE Router running firmware version V3.4.3. The flaw resides in the /ajax web management API endpoint exposed by MifiService.apk. A remote attacker can invoke this endpoint without proper access controls to execute arbitrary code on the device. The vulnerability enables full compromise of the router, which acts as a network gateway for connected clients.
Critical Impact
Unauthenticated remote attackers can execute arbitrary code on affected UZ801 4G LTE routers via the /ajax API endpoint, enabling gateway compromise, traffic interception, and lateral movement into connected networks.
Affected Products
- Generic OEM UZ801_v2.1 4G LTE Router
- Firmware version V3.4.3
- MifiService.apk web management component
Discovery Timeline
- 2026-07-08 - CVE-2026-52200 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-52200
Vulnerability Analysis
The UZ801_v2.1 4G LTE Router exposes a web management interface backed by MifiService.apk, an Android application service running on the device. The /ajax endpoint within this service handles administrative API requests but fails to enforce authentication or authorization checks on incoming requests. An attacker with network reachability to the router's management interface can issue crafted requests to this endpoint. Successful exploitation leads to arbitrary code execution in the context of the MifiService component.
Root Cause
The root cause is broken access control on the /ajax web management API endpoint in MifiService.apk. The endpoint accepts and processes administrative commands without validating the identity or privileges of the requester. This design flaw allows any client that can reach the router's HTTP interface to invoke privileged operations.
Attack Vector
Exploitation requires network access to the router's web management interface. The attacker sends crafted HTTP requests to the /ajax endpoint exposed by MifiService.apk. No authentication is required, and no user interaction is needed. Public proof-of-concept material is available in the GitHub PoC Repository and the UZ801 MifiService Broken Access Control Repository. Technical exploitation details are documented in these external references rather than reproduced here.
Detection Methods for CVE-2026-52200
Indicators of Compromise
- Unexpected HTTP requests targeting the /ajax path on the router's management interface from untrusted sources.
- Anomalous outbound connections originating from the router itself, indicating post-exploitation activity.
- Unauthorized configuration changes on the router, including DNS, routing table, or firewall rule modifications.
- New or unknown processes running under the MifiService.apk context.
Detection Strategies
- Monitor network traffic to the router's management interface for HTTP requests to /ajax from clients that are not authorized administrators.
- Inspect router logs for API calls that lack corresponding administrative session context.
- Baseline outbound traffic from the router and alert on deviations such as new destinations, ports, or protocols.
Monitoring Recommendations
- Deploy network sensors between the LAN and the router to capture management-plane traffic for retrospective analysis.
- Aggregate router syslog and DHCP data into a centralized SIEM for correlation with endpoint telemetry.
- Track connected client behavior for signs of man-in-the-middle interception, such as unexpected certificate warnings.
How to Mitigate CVE-2026-52200
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs or hosts only.
- Disable remote WAN-side management if it is enabled on affected devices.
- Isolate affected routers from sensitive network segments until a vendor fix is available.
- Rotate any credentials or keys that may have transited the compromised gateway.
Patch Information
No vendor patch is referenced in the enriched CVE data at the time of publication. The affected device is described as a Generic OEM product, and no vendor advisory URL is currently available. Operators should contact their device supplier for firmware guidance and monitor the GitHub PoC Repository for further technical updates.
Workarounds
- Place the router behind an upstream firewall that filters access to the management interface.
- Block inbound traffic to the /ajax endpoint at a network proxy or access control device where feasible.
- Replace the affected UZ801_v2.1 device with a supported model that receives security updates if no vendor patch becomes available.
# Example firewall rule to restrict router management access to a trusted admin host
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 192.0.2.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
