UTT 518G
CVE-2025-11652
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface with low-priv credentials
-
DeliverySend crafted request to /goform/formTaskEdit_ap
-
ExploitOverflow buffer via oversized txtMin2 argument
-
ExecutionCorrupt memory for code execution/crash
-
ImpactCompromise or disrupt router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's web management interface and the ability to invoke the /goform/formTaskEdit_ap endpoint while supplying an oversized txtMin2 argument. Per the CVSS 4.0 vector (PR:L), the attacker must hold at least low-level credentials/authentication to the router - limiting exploitation to users who can already log in to or access the authenticated web console. No user interaction is required (UI:N) and attack complexity is low (AC:L). The practical limiting factors are the authentication requirement and the narrow deployment of the UTT 518G product; there is no indication the vulnerable endpoint is exposed pre-authentication or to the WAN by default. |
| Impact | Signals are mixed and point to a real but limited-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remote, low-complexity attack but explicitly requires low-level privileges (PR:L), so this is an authenticated flaw, not a drive-by unauthenticated compromise. A public exploit exists (E:P, POC confirmed), which raises practical risk, yet the EPSS score is only 0.84% (56th percentile), indicating no observed mass-exploitation activity. The CVE is NOT in CISA KEV, so there is no evidence of active real-world exploitation. The high VC:H/VI:H/VA:H impact reflects potential full device compromise of the router, but the combination of an obscure product, required authentication, and low EPSS means this is a moderate-severity issue (7.4) best triaged as routine rather than emergency. Note the conflict to verify: the description says 'The attack may be performed from remote' with no mention of authentication, while the vendor-assigned CVSS uses PR:L - the authenticated qualifier derives from the CVSS vector, not the prose, and should be confirmed against the actual endpoint behavior. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web management interface sends a crafted request to /goform/formTaskEdit_ap with an overlong txtMin2 parameter, triggering a buffer overflow in the handler. Because public exploit code is already available, an attacker on the same network or with harvested/default credentials could reproduce the crash or potentially achieve code execution to take over the device. Exploitation requires reaching the web interface and holding at least low-level credentials per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A buffer overflow in the UTT 518G router firmware (up to V3v3.2.7-210919-161313) is reachable through the authenticated web management endpoint /goform/formTaskEdit_ap, where an oversized txtMin2 argument overwrites memory and can lead to high-integrity/high-availability impact on the device, with the assessed CVSS 3.1 base score of 8.8 and the vendor-published CVSS 4.0 score of 7.4. The CVSS 4.0/3.1 vectors both carry PR:L, meaning the attacker must already hold at least low-level credentials on the router, so the practical exposure is limited to users who can log in to the web console rather than any remote unauthenticated party on the internet. Publicly available exploit code exists (linked from a GitHub PoC write-up), but there is no CISA KEV listing and EPSS is only 0.84% (56th percentile), so signals are mixed and this is a real but limited-priority issue.
RemediationAI
No vendor-released patch was identified at time of analysis: UTT was contacted early about this disclosure and did not respond, and there is no confirmed fixed firmware version, so remediation must currently rely on compensating controls. The most effective measure is to stop the vulnerable handler from being reachable by untrusted parties - restrict the 518G web management interface to a dedicated management VLAN or a tightly scoped source-IP allowlist on the LAN, and confirm that remote/WAN administration and any port-forwarding or UPnP/NAT rules that expose the HTTP management port are disabled (trade-off: administrators lose convenient remote access and must use a VPN or jump host). Because the vector requires at least low-level credentials (PR:L), rotate default and shared administrator passwords, remove unused accounts, and enforce strong unique credentials so an outsider cannot reach /goform/formTaskEdit_ap at all; this does not fix the overflow but raises the bar. As additional hardening, place the device behind a reverse proxy or WAF that can reject abnormally long parameters to formTaskEdit_ap (trade-off: added latency and possible breakage of legitimate task-scheduling forms), and segment the 518G so that a compromised management session cannot pivot to other network assets (trade-off: added firewall complexity and potential disruption of routing features). Monitor device logs and upstream IDS/IPS for POST requests containing oversized txtMin2 values as a detection and containment measure, and treat the 518G as end-of-support if UTT continues to be unresponsive - replacing the device with a supported gateway is the only definitive fix. Reference material, including the public PoC, is available at https://github.com/cymiao1978/cve/blob/main/14.md and https://github.com/cymiao1978/cve/blob/main/14.md#poc.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class here: the goform CGI handler behind /goform/formTaskEdit_ap copies the user-supplied txtMin2 parameter into a fixed-size stack or heap buffer in the embedded router firmware without adequately validating its length, allowing adjacent memory to be corrupted. UTT's goform interface is the classic Embedded Linux / Boa (or similar) HTTPd CGI dispatch layer used by consumer and SMB routers, where each /goform/<name> path maps to a handler compiled into the firmware image. The affected asset is classified in the CPE dictionary as cpe:2.3:o:utt:518g_firmware:*:*:*:*:*:*:*:*, i.e., the operating-system/firmware component of the 518G gateway, not an application layer. Because the vulnerable code runs in the management-plane CGI process, a successful overflow can corrupt control flow and, at minimum, crash the web daemon (A:H) and potentially allow code execution with the privileges of that process (C:H/I:H). The CVSS 4.0 vector confirms network reachability (AV:N), low attack complexity (AC:L), no user interaction (UI:N) and no attack requirements (AT:N), with exploit maturity marked E:P (proof-of-concept) - consistent with the public write-up rather than confirmed in-the-wild use.
Know when 518G Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote network reach to an authenticated web endpoint (AV:N, PR:L per vendor vector), low complexity, and a memory-corruption bug on an embedded router yielding potential full device compromise (C/I/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in UTT 进取 518G up to V3v3.2.7-210919-161313. This issue affects some unknown processing of the file /goform/formTaskEdit_ap. The manipulation of the argument txtMin2 results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 518G router firmware (up to V3v3.2.7-210919-161313) contains a buffer overflow that can be triggered by an authenticated user through the web management interface, potentially leading to device compromise and network disruption. Publicly available exploit code exists, and no vendor-released patch identified at time of analysis, increasing the risk to organizations using these routers. Leadership should prioritize mitigating exposure by restricting management access and monitoring for exploitation attempts, as the vulnerability could impact network availability and data integrity.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting management interface access to trusted IPs, disabling remote management, enforcing strong authentication, network segmentation, monitoring for exploitation attempts, and deploying virtual patching via WAF/IPS if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB