UTT 进取 520W CVE-2025-14141

Exploitation requires reaching the device's HTTP management interface and sending a request to the /goform/formArpBindConfig handler with an oversized 'pools' argument (the ARP-binding configuration feature). Per the CVSS 4.0 vector (PR:L), a low-privileged/authenticated session to the web UI is required, which is the primary limiting factor; no user interaction is needed (UI:N) and attack complexity is low (AC:L). Further limits: exploitation is confined to the specific firmware build UTT 进取 520W 1.7.7-180627, and practical remote reach depends on whether the admin interface is exposed to the WAN or only the LAN. No vendor patch is available, so mitigation relies on restricting management-interface access.

Signals are mixed and point to a real-but-low-urgency issue. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H, score 7.4) describes a network-reachable, low-complexity flaw with full confidentiality/integrity/availability impact but requiring some privileges (PR:L, i.e. an authenticated session to the router's web interface). Publicly available exploit code exists (github-poc), which raises practical risk, but this is distinct from active exploitation: the CVE is NOT in CISA KEV, so per precision rules there is no confirmed in-the-wild activity. EPSS is low at 0.16% (37th percentile), consistent with a niche Chinese SOHO/enterprise router rather than a mass-exploited internet target. The SSVC-relevant data point (E:P = Proof-of-Concept in the 4.0 vector) agrees with the POC signal and argues against treating this as weaponized. Net: a legitimate vulnerability with working POC but modest real-world priority, dominated by the unpatched vendor situation (vendor did not respond) rather than by exploitation pressure. One caveat: PR:L assumes the /goform ARP-binding endpoint requires authentication; if the device exposes this endpoint without auth in default or common configurations, effective privilege requirement could be lower than the vector implies - verify against the device.

An attacker with access to the router's web management interface (e.g. a logged-in or weakly-authenticated session, or an exposed LAN/WAN admin panel) sends a crafted POST to /goform/formArpBindConfig with an overlong 'pools' parameter. The unbounded strcpy overflows a stack/heap buffer, crashing the device or enabling arbitrary code execution. Public exploit code is already available, lowering the skill needed to reproduce it.