UTT 1250GW CVE-2025-11323

Exploitation requires network access to the UTT 1250GW web management interface AND valid low-privilege authentication (CVSS PR:L) - it is not a pre-authentication remote compromise. The specific trigger is a request to the /goform/formUserStatusRemark endpoint with an overlong Username parameter, which reaches an unbounded strcpy copy into a fixed buffer. Limiting factors: an attacker must already hold at least low-level credentials on the device, and exposure depends on whether the management interface is reachable from the attacker's network position (typically LAN-side or, if misconfigured, WAN-exposed). No user interaction is required (UI:N).

This is a moderate-priority issue whose signals are largely consistent but point to limited real-world urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack but one that requires low-level privileges (PR:L) - i.e. an authenticated user on the device's web interface - with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H) and no scope change. The EPSS score is low at 0.75% (54th percentile), indicating no evidence of widespread or automated exploitation despite a publicly disclosed exploit. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation; the only exploitation signal is the public POC (E:P, 'Proof-of-Concept' in the vector). The combination of a public POC with low EPSS and no KEV listing suggests opportunistic or research-grade exploit availability rather than mass exploitation. Note a tension to verify: the PR:L requirement means this is not a pre-authentication remote compromise, which meaningfully lowers practical risk versus the headline 'remote exploitation possible' phrasing in the description. The vendor was contacted but did not respond, so no patch exists - this raises residual risk for exposed/authenticated-accessible devices even though the overall exploitation probability is currently low.

An attacker with low-privilege web credentials on a UTT 1250GW device sends a crafted request to /goform/formUserStatusRemark with an overly long Username value, overflowing a fixed-size buffer in the strcpy call. A publicly available exploit has been disclosed (via the referenced GitHub issue), potentially enabling denial of service or code execution against the router. Because PR:L is required, the attacker must first obtain or already hold valid low-level authentication to the management interface.