CVE-2026-84059: ICP DAS UA-2200/UA-5200 RCE Vulnerability

CVE-2026-84059 Overview

CVE-2026-84059 is a command injection vulnerability affecting ICP DAS UA-2200 and UA-5200 industrial gateway devices up to firmware version 20260704. The flaw resides in the ArmAngstromInstructionSet function invoked by the /CGI?RestApi=SetHostname endpoint. An attacker who manipulates the ParameterArray argument can inject arbitrary operating system commands. The attack executes remotely over the network and requires low-level authenticated access. A public exploit exists, and the vendor did not respond to disclosure attempts. The weakness is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Authenticated remote attackers can inject operating system commands into ICP DAS UA-2200 and UA-5200 gateways, with a public exploit already available and no vendor patch released.

Affected Products

ICP DAS UA-2200 (firmware up to 20260704)
ICP DAS UA-5200 (firmware up to 20260704)
Web management interface exposing /CGI?RestApi=SetHostname

Discovery Timeline

2026-09-01 - CVE-2026-84059 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database
2026-09-03 - EPSS score published at 1.568% (73.6 percentile)

Technical Details for CVE-2026-84059

Vulnerability Analysis

The vulnerability exists in the CGI handler that processes hostname configuration requests on ICP DAS UA-2200 and UA-5200 IIoT communication gateways. The endpoint /CGI?RestApi=SetHostname dispatches to the ArmAngstromInstructionSet function, which incorporates attacker-controlled data from the ParameterArray argument into a downstream command context without adequate neutralization. Because the affected devices sit at the boundary between operational technology (OT) networks and enterprise IT networks, successful exploitation can pivot into industrial control environments. The vendor was contacted early during coordinated disclosure and did not respond, leaving the affected firmware unpatched.

Root Cause

The defect maps to CWE-74: user-supplied values in ParameterArray are passed to a system-level execution context without proper escaping or allowlist validation. The hostname setter accepts arbitrary strings that flow into an underlying shell or command interpreter, breaking the trust boundary between web request parameters and OS command construction.

Attack Vector

The attack is network-accessible and requires low-privilege authentication to the gateway management interface. An attacker sends a crafted HTTP request to /CGI?RestApi=SetHostname with a malicious ParameterArray payload containing shell metacharacters. The injected commands execute in the context of the CGI process, typically with elevated privileges on the embedded Linux firmware. Refer to the VulDB CVE Report and VulDB Vulnerability Details for the public technical write-up and proof-of-concept references.

// No verified exploit code republished here.
// See linked VulDB and Feishu references for the public proof-of-concept details.

Detection Methods for CVE-2026-84059

Indicators of Compromise

HTTP requests to /CGI?RestApi=SetHostname containing shell metacharacters such as ;, |, &, backticks, or $(...) inside the ParameterArray parameter.
Unexpected outbound network connections originating from UA-2200 or UA-5200 devices, particularly to non-industrial destinations.
Modifications to gateway configuration files or the appearance of new processes on the embedded Linux runtime.

Detection Strategies

Deploy network intrusion detection signatures that inspect HTTP payloads targeting RestApi=SetHostname for command-injection patterns.
Correlate authentication events on gateway management interfaces with subsequent hostname change requests to identify anomalous administrative activity.
Baseline normal management traffic to ICP DAS gateways and alert on deviations in request structure or source IP.

Monitoring Recommendations

Log all CGI requests at network chokepoints between IT and OT segments, retaining full URI and body content for forensic review.
Monitor firmware integrity and configuration checksums on UA-2200 and UA-5200 devices to detect unauthorized changes.
Alert on any new listening services, cron entries, or persistence mechanisms appearing on ICP DAS gateways.

How to Mitigate CVE-2026-84059

Immediate Actions Required

Remove ICP DAS UA-2200 and UA-5200 management interfaces from any network reachable by untrusted users, restricting access to a dedicated engineering VLAN.
Rotate all administrative credentials on affected gateways, since exploitation requires low-privilege authentication that may already be compromised.
Audit recent hostname configuration changes and CGI request logs for the SetHostname endpoint to detect prior exploitation attempts.

Patch Information

No vendor patch is available. The VulDB CVE Report notes that the vendor was contacted early during disclosure and did not respond. Operators must rely on compensating controls until ICP DAS issues fixed firmware. Monitor the vendor's advisory channels and the referenced Feishu Wiki Document for updates.

Workarounds

Place UA-2200 and UA-5200 gateways behind a firewall or industrial DMZ that permits management traffic only from named engineering workstations.
Enforce network segmentation between IT and OT networks per the Purdue Model and IEC 62443 zone-and-conduit guidance.
Disable or block access to the /CGI?RestApi=SetHostname endpoint at an upstream reverse proxy or web application firewall if hostname configuration is not required in production.
Require VPN or jump-host access with multi-factor authentication for any administrative session to affected gateways.

bash

# Example iptables restriction limiting management access
# to a single engineering workstation (adjust interface and IPs).
iptables -A INPUT -i eth0 -p tcp --dport 80 -s 10.10.20.15 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -s 10.10.20.15 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP