UTT 512W
CVE-2025-14534
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device web interface
-
DeliverySend crafted formNatStaticMap request
-
ExploitOverflow NatBind buffer via strcpy
-
ExecutionCorrupt stack / hijack control flow
-
ImpactCrash device or execute code
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's web management interface and the ability to send a request to the /goform/formNatStaticMap handler with an attacker-controlled NatBind argument; the overflow is triggered by an overlong value copied via strcpy into a fixed buffer. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated, so against a default/exposed management interface this is remotely triggerable without credentials. The primary limiting factor is exposure of the management interface: if the web admin service is bound only to the LAN (typical SOHO default), remote internet exploitation requires the interface to be WAN-exposed or the attacker to be LAN-adjacent. Applies only to UTT 512W firmware versions up to 3.1.7.7-171114. |
| Impact | Signals are moderately aligned toward a credible but not top-tier priority. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.9) indicates a remote, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity, and availability - consistent with a classic strcpy stack buffer overflow in an embedded HTTP handler. A public exploit exists (referenced GitHub issue), and EPSS is elevated at 5.72% (93rd percentile), which is high relative to the overall CVE population and reflects the presence of disclosed PoC code. However, this CVE is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation - the exploitation status is limited to 'publicly available exploit code exists.' The 'E:P' (Proof-of-Concept) exploit-maturity value in the vendor vector agrees with this. Two tempering factors: (1) the affected product (UTT 进取/ScholarPro 512W) is a niche Chinese SOHO/SMB router with a small deployment footprint, so even reliable exploitation has limited blast radius; and (2) VulDB auto-generated CVSS/impact ratings for SOHO-router overflows are frequently inflated toward full C/I/A:H when the real-world outcome may be only a device crash (DoS) rather than confirmed code execution - the description states only 'buffer overflow,' not demonstrated RCE. Net: a genuine, remotely reachable overflow with public PoC and high EPSS, but low prevalence and an unconfirmed true impact ceiling keep it below the tier of mass-exploited edge-device CVEs. |
| Exploit ScenarioDerived | A remote attacker on a network path to the device's web management interface sends a crafted request to /goform/formNatStaticMap with an overlong NatBind parameter, overflowing a fixed-size stack buffer copied via strcpy. A proof-of-concept is publicly available (GitHub), lowering the skill required to reproduce the crash or potential code execution. Because the attack is unauthenticated (per PR:N) and network-reachable, any exposed or LAN-adjacent management interface is at risk. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Remote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corrupt memory and potentially achieve code execution by sending a crafted request to the /goform/formNatStaticMap endpoint with an overlong NatBind parameter. Per the CVSS vectors (PR:N/UI:N), no credentials or user interaction are required, so the practical limiting factor is exposure of the device's web management interface - a LAN-only default blocks internet exploitation, while WAN-exposed or LAN-adjacent attackers can trigger it directly. Publicly available exploit code exists and EPSS places the flaw at roughly the 93rd percentile (5.72%), indicating elevated relative interest, though there is no CISA KEV entry confirming active exploitation; the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the vendor did not respond to the disclosure, so operators must rely on compensating controls rather than waiting for an upgrade. The most effective immediate measure is to remove reachability to the web management interface from untrusted networks: disable WAN-side administration, bind the admin HTTP/HTTPS service to the LAN interface only, and block the management port at the upstream firewall so that only trusted administrative subnets can reach /goform/formNatStaticMap - the trade-off is that remote administration must then go through a VPN or jump host. If the interface must remain reachable, place the device behind a firewall/VPN and restrict access to a small set of source IPs, accepting that any LAN-adjacent host (including compromised IoT devices) can still reach the handler and trigger the overflow. Where an IPS/WAF or reverse proxy can be inserted, deploy a signature that rejects or length-limits the NatBind parameter on POSTs to /goform/formNatStaticMap, keeping in mind that such parsing may be bypassed by encoding tricks and does not fix the underlying strcpy() flaw. Network segmentation that isolates the 512W from other subnets limits lateral movement if exploitation succeeds, and logging/monitoring of the management interface should be enabled to catch crash-restart cycles or anomalous long-parameter requests. Operators should also subscribe to the VulDB entry (https://vuldb.com/?id.335873) and the referenced PoC issue (https://github.com/maximdevere/CVE2/issues/6) for any future firmware fix, and consider replacing the device if the vendor remains unresponsive.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2025-14534 is a classic memory-safety failure (CWE-119) in embedded router firmware: the /goform/formNatStaticMap HTTP handler - the GoAhead-style form-processing path used to configure NAT static port mappings - passes the attacker-supplied NatBind argument directly into strcpy() without validating its length against the destination buffer. Because strcpy() performs no bounds checking, an overlong NatBind value overwrites adjacent memory, which can crash the web service or, with sufficient control over the payload, hijack execution flow on the device. The CPE record (cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*) confirms the affected asset is the UTT 512W firmware image itself rather than a separately versioned application, meaning the vulnerable code is baked into the device OS and cannot be updated independently of a vendor firmware release. Both the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, high confidentiality/integrity/availability impact, internet-exploitable scope) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that the bug is remotely reachable and needs neither authentication nor user interaction; the only meaningful precondition is that the management interface is reachable from the attacker's network position.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remote unauthenticated reach to the goform handler (AV:N/AC:L/PR:N/UI:N); strcpy overflow plausibly yields code execution with full C/I/A, though impact is vendor-asserted not proven.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of the component Endpoint. Executing manipulation of the argument NatBind can lead to buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity buffer overflow in UTT 512W router firmware through version 3.1.7.7-171114 could allow unauthenticated network attackers to corrupt memory and potentially execute code on affected devices. Because these routers may serve as edge or branch gateways, a compromise could expose internal networks to lateral movement, traffic interception, or persistent adversary access. Leadership should direct immediate discovery and containment of any WAN-exposed or LAN-adjacent UTT 512W devices, especially since no vendor-released patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the web management interface to trusted LAN or management VLANs, removing all WAN exposure, blocking external access to /goform/formNatStaticMap, deploying IPS/WAF signatures for overlong NatBind parameters, segmenting affected devices, monitoring for exploitation attempts, and planning hardware replacement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allA stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB