UTT HiPER 2620G CVE-2025-11653

Exploitation requires reaching the device's web management interface and invoking the /goform/fNTP handler with an attacker-controlled NTPServerIP parameter that exceeds the destination buffer size used by strcpy; per the supplied CVSS vector (PR:L) a low-privilege authenticated session to the management interface is required, which is the primary limiting factor along with network reachability of the admin interface (typically LAN-side or exposed WAN management). No user interaction is needed (UI:N). The flaw affects UTT HiPER 2620G firmware versions up to and including 3.1.4; devices on unaffected versions or with the management interface restricted to trusted networks are not exposed. Note the description itself does not confirm the authentication requirement - it is taken from the CVSS metric.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) describes a network-reachable, low-complexity stack buffer overflow that requires only low-privilege authentication and yields full compromise of the device's confidentiality, integrity and availability, which is credible for a strcpy overflow of an attacker-controlled NTPServerIP argument on an embedded router web endpoint (/goform/fNTP). Publicly available exploit code exists (referenced on GitHub), raising practical exploitability above the base score alone. However, EPSS is low at 0.75% (54th percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active, widespread exploitation - the POC indicates capability, not observed attacks. The embedded vector E:P (Proof-of-Concept) in the 4.0 string corroborates POC-but-not-weaponized status. Net: this is a real, reachable code-execution flaw on an unpatched product (vendor non-responsive), but current real-world risk is tempered by the PR:L authentication requirement, low EPSS, absence of KEV listing, and the product's limited deployment footprint. Treat as a genuine priority for anyone operating this specific device, but not an internet-wide emergency. Note: PR:L assumes attacker authentication to the device management interface - the description does not explicitly state an auth requirement, so this is inferred solely from the provided CVSS vector and should be verified against the actual /goform/fNTP handler.

An attacker with low-privilege access to the UTT HiPER 2620G web management interface sends a crafted request to /goform/fNTP with an overlong NTPServerIP value, overflowing a fixed-size buffer in a strcpy call. Because publicly available exploit code already exists, a low-skill attacker can reuse it to crash the device or execute arbitrary code, taking full control of the router. Exploitation is remote over the network but gated by the need for valid (low-level) credentials or an authenticated session.