UTT 1250GW CVE-2025-11355

Exploitation requires network access to the UTT 1250GW device web/management interface and the ability to invoke the /goform/aspChangeChannel endpoint with an attacker-controlled pvid parameter. Per the CVSS vector (PR:L), a low-privilege authenticated session to the device is required, which is the primary limiting factor - this is not an unauthenticated flaw. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the overflow is reliably triggerable. Affected scope is firmware up to v2v3.2.2-200710; no fixed version exists because the vendor did not respond and no patch is referenced.

This is a buffer overflow (CWE-119) in the UTT 1250GW gateway firmware, reached via the strcpy handling of the pvid parameter in /goform/aspChangeChannel. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) indicates a network-reachable, low-complexity attack that requires low-privilege authentication (PR:L) and yields high impact to confidentiality, integrity and availability - consistent with memory corruption on an embedded device. The E:P exploit-maturity flag and the referenced public PoC confirm that exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation. A notable limiting signal is PR:L: exploitation requires some level of authentication to the device web interface, which tempers the raw network-exploitability picture. The vendor was contacted but did not respond and no patch is referenced, so this is an unpatched flaw in an end-of-attention product. Net assessment: a credible, moderate-to-high technical risk on affected devices, but real-world priority is constrained by the niche deployment footprint and the authentication requirement; it is unlikely to be a mass-exploitation target absent KEV/EPSS evidence.

An attacker with low-privilege access to the 1250GW management web interface sends a crafted request to /goform/aspChangeChannel with an overlong pvid value, overflowing a fixed-size buffer copied by strcpy. The disclosed public PoC demonstrates the overflow, which can crash the service or potentially allow attacker-controlled code execution on the gateway. Because the vector is network-based with low complexity, the request can be delivered remotely once the attacker can reach and authenticate to the interface.