UTT 518G CVE-2025-11651
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to 518G web interface
-
DeliverySend crafted /goform/formRemoteControl request
-
ExploitOverflow buffer via oversized Profile argument
-
ExecutionCorrupt memory in sub_4247AC handler
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the device's HTTP management service at the /goform/formRemoteControl endpoint and supplying a malicious Profile parameter to the sub_4247AC function on a UTT 518G running firmware up to V3v3.2.7-210919-161313. Per the CVSS PR:L metric, the attacker needs at least low-privilege authenticated access to the web interface, which is the primary limiting factor; no user interaction is required (UI:N). Realistic risk is further bounded by exposure of the management interface - devices that restrict the admin/web UI to trusted internal networks are substantially harder to reach, whereas any 518G with its management port exposed to untrusted networks is directly at risk. No vendor patch is available, so mitigation depends on network-level access controls. |
| Impact | This is a moderate-priority issue whose signals mostly align but fall short of top-tier urgency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity buffer overflow with no user interaction, and the E:P exploit-maturity flag plus a published PoC confirm that working exploit code exists. However, PR:L means the attacker must first hold at least low-level authenticated access to the device's web management interface, which materially limits mass, drive-by exploitation. No EPSS score and no CISA KEV entry were provided, so there is no evidence of active, widespread exploitation - the data indicates 'publicly available exploit code exists,' not 'in the wild.' The source is a single VulDB/NVD submission (cna@vuldb.com) with the vendor explicitly non-responsive, meaning affected-version and patch data are unverified by the vendor. Net: a real, exploitable memory-corruption flaw with full C/I/A impact, but gated by authentication and affecting a niche product, so it is a genuine-but-not-emergency priority best treated as a prompt patch/mitigation on exposed devices rather than a fire-drill. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege credentials (or access to an exposed management interface) on a UTT 518G router sends a crafted request to /goform/formRemoteControl with an oversized or malformed Profile argument, overflowing a buffer in the sub_4247AC handler. Because a public PoC is available, this can be reproduced reliably to crash the device or potentially execute attacker-controlled code with the web service's privileges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Remote buffer overflow in the UTT 518G router's web management firmware (up to V3v3.2.7-210919-161313) allows an authenticated attacker to corrupt memory via a malicious Profile parameter submitted to the /goform/formRemoteControl endpoint, which is processed by the sub_4247AC function without bounds checking; successful exploitation can result in memory corruption with high impact to confidentiality, integrity and availability of the device. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the primary limiting factor is the need for at least low-privilege authenticated access plus network reachability of the management interface.
RemediationAI
No vendor-released patch was identified at time of analysis: UTT was contacted about the disclosure but did not respond, and no fixed firmware version is published in the available references, so operators cannot rely on a vendor update. The most effective compensating control is to eliminate reachability of the vulnerable endpoint - restrict the HTTP management interface (/goform/formRemoteControl and the web UI generally) to a trusted management VLAN or internal network via firewall ACLs, and disable any WAN-side remote administration setting; the trade-off is that out-of-band or remote administration then requires a VPN or jump host. Administrative credentials should be rotated and strong authentication enforced, since the assessed vector (PR:L) requires only low-privilege authenticated access, meaning weak or default credentials materially lower the attack barrier; note this does not fix the underlying memory-safety flaw. Where feasible, segment 518G devices onto an isolated network with egress filtering to limit post-exploitation movement, and enable logging/IDS signatures for anomalous POST requests to /goform/formRemoteControl. Because a public PoC exists at https://github.com/cymiao1978/cve/blob/main/13.md, exploitation attempts may be scripted and widespread, so monitor device availability for crashes consistent with a denial-of-service outcome. Continue tracking VulDB entries (https://vuldb.com/?id.328068) for any future vendor firmware release and apply it once available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded HTTP management service of the UTT 518G router firmware, identified by CPE cpe:2.3:o:utt:518g_firmware:*:*:*:*:*:*:*:* (firmware, all versions in the unconstrained range up to V3v3.2.7-210919-161313). The /goform/formRemoteControl handler passes the user-supplied 'Profile' argument into the function sub_4247AC, which fails to validate the length of the input before copying it into a fixed-size buffer. This is a classic CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) condition, a memory-safety class of bug that in embedded web handlers typically manifests as a stack- or heap-based buffer overflow, potentially enabling memory corruption and, in the worst case, control-flow hijacking or denial of service. The vulnerability is network-reachable through the device's HTTP management interface, and because it resides in firmware of an IoT/CPE router, exploitation could grant an attacker a foothold on the device and, depending on the deployed configuration, on the adjacent network. No vendor advisory or patched firmware image accompanies the CPE data, and the disclosure references only the public PoC and VulDB entries.
Know when 518G Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remotely reachable HTTP endpoint (AV:N) with a straightforward overflow (AC:L) requiring authenticated low-privilege web access (PR:L); memory corruption yields full code-execution/crash impact (C:H/I:H/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in UTT 进取 518G up to V3v3.2.7-210919-161313. This vulnerability affects the function sub_4247AC of the file /goform/formRemoteControl. The manipulation of the argument Profile leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 518G router, commonly deployed as a network gateway, is affected by a high-severity memory corruption vulnerability in firmware up to V3v3.2.7-210919-161313 that an authenticated low-privilege attacker with management network access can exploit. Publicly available exploit code exists, and no vendor-released patch was identified at time of analysis, creating risk of device compromise that could disrupt network availability and expose or alter sensitive traffic. Leadership should prioritize containment and compensating controls for affected devices because these routers often sit at trust boundaries.
No vendor-released patch identified at time of analysis; interim mitigations include restricting management interface access, disabling remote management, enforcing network segmentation and ACLs, using IPS/WAF rules for /goform/formRemoteControl, rotating credentials, and monitoring for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB