UTT 512W
CVE-2025-14535
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web management interface
-
DeliverySubmit crafted request to /goform/formConfigFastDirectionW
-
ExploitOverflow buffer via oversized ssid in strcpy
-
ExecutionCorrupt memory to execute code or crash
-
ImpactGain device control or deny service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the UTT 512W web management service and the ability to send a request to the /goform/formConfigFastDirectionW handler with an attacker-controlled 'ssid' parameter long enough to overflow the fixed-size buffer copied via strcpy. Affected versions are UTT 512W firmware up to and including 3.1.7.7-171114. Practical limiting factors: the management interface is normally exposed only on the LAN unless remote/WAN administration is explicitly enabled, and this is a device-configuration form that on typical router firmware requires an authenticated administrative session - the CVSS PR:N claim that it is reachable unauthenticated is not substantiated by the description and should be verified before treating it as a pre-auth bug. No fixed firmware is available because the vendor did not respond to disclosure. |
| Impact | Signals are mixed and point to a moderately elevated but not top-tier priority. The vendor CVSS 4.0 score of 8.9 (AV:N/AC:L/PR:N/UI:N, VC:H/VI:H/VA:H) with E:P (Proof-of-Concept) describes a network-reachable, low-complexity, unauthenticated memory-corruption flaw with full confidentiality/integrity/availability impact on the device - classic SOHO-router RCE potential. EPSS is 5.63% (93rd percentile), which is elevated relative to the average CVE but still indicates low absolute probability of broad exploitation in the next 30 days. There is NO CISA KEV listing, so there is no confirmed active exploitation; the only exploitation signal is a publicly available PoC hosted on GitHub. A key conflict: the CVSS vector asserts PR:N (unauthenticated), but the affected endpoint /goform/formConfigFastDirectionW is a device configuration handler that on most router web UIs sits behind an authenticated admin session - verify whether this form is truly reachable pre-authentication, as this materially changes risk. Net assessment: a real but narrow-footprint RCE in a niche Chinese router, with public PoC but no evidence of in-the-wild use and an unresponsive vendor (no patch), making it a meaningful risk only to organizations that actually deploy UTT 512W devices with exposed management interfaces. |
| Exploit ScenarioDerived | An attacker able to reach the UTT 512W web management interface (LAN-side by default, or WAN-side if remote administration is enabled) submits a request to /goform/formConfigFastDirectionW with an overly long 'ssid' argument, overflowing a fixed-size buffer via an unsafe strcpy. A public proof-of-concept exists, lowering the effort to trigger the overflow and potentially achieve code execution or a denial of service on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an attacker who can reach the device's web management interface overwrite memory in the HTTP/form handler by sending an oversized 'ssid' parameter to /goform/formConfigFastDirectionW, potentially achieving arbitrary code execution with the privileges of the web service or crashing the device. Publicly available exploit code exists, and EPSS places the flaw at roughly 5.63% (93rd percentile) of exploitation likelihood in the next 30 days, although it is not listed in CISA KEV and no confirmed active exploitation has been reported. The vendor was contacted but did not respond, so no fixed firmware has been released; notably, the supplier's CVSS 4.0 vector claims an unauthenticated attack (PR:N), while our assessment rates it as requiring an authenticated administrative session (PR:L) and access to the management service, which is normally LAN-only unless remote administration is enabled.
RemediationAI
No vendor-released patch or fixed firmware version is identified at time of analysis - UTT was contacted early and did not respond - so operators must rely on compensating controls. The highest-value mitigation is to disable remote/WAN administration and expose the UTT 512W web UI only on a trusted management VLAN or LAN segment, blocking TCP access to the management ports at the perimeter and from guest or wireless-client networks; the trade-off is loss of convenient off-site management, which should be replaced with VPN access into the management segment. Ensure the management interface is protected by a strong, unique administrative password (never factory defaults) to raise the bar given the disputed pre-auth claim, and restrict who can reach /goform/formConfigFastDirectionW by ACL or firewall rule where the firmware permits. Enable logging and, where available, upstream IDS/IPS signatures for oversized 'ssid' parameters in HTTP POST bodies to /goform/ paths, and monitor for crashes or reboots of the device as an indicator of attempted exploitation. Because the stack overflow is reachable through a configuration form, changes to the router's SSID or fast-direction settings should be audited for unexpected values. Longer term, replace the device or isolate it on a dedicated segment until UTT publishes firmware that bounds-checks the ssid parameter; vulnerability and advisory tracking is available at https://vuldb.com/?id.335874 and the proof-of-concept reference at https://github.com/maximdevere/CVE2/issues/7.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management daemon of the UTT 512W router, which exposes configuration handlers under /goform/. The vulnerable handler, formConfigFastDirectionW, reads an attacker-supplied 'ssid' value from the HTTP request and copies it into a fixed-size destination buffer using strcpy, a C library function that performs no length validation - the classic root cause classed as CWE-119 (improper restriction of operations within the bounds of a memory buffer). Because the destination is a stack buffer, an overlong value overwrites adjacent stack memory, including saved registers and the return address, which can redirect execution (code execution, typically as the web service's user, often root on embedded firmware) or simply crash the daemon (denial of service). The CPE data (cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*) identifies the target as UTT's 512W firmware operating system image rather than a discrete application, consistent with the vulnerability living in firmware-resident code that cannot be updated independently of a vendor firmware release. Reachability is the key gating factor: the handler is part of the administrative surface, so exploitation depends on network access to the web UI and, per our assessment, an authenticated administrative session - the CVSS 4.0 PR:N claim from the CNA is not corroborated by the available description or by how consumer/SMB router management forms normally behave.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable, low-complexity strcpy overflow; PR:L because a device configuration endpoint normally requires an authenticated admin session, with full host C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. The manipulation of the argument ssid leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 512W router, typically deployed as a small-site gateway and network edge device, carries a memory-corruption flaw in its web management interface that could allow an attacker to seize control of the device or take it offline, disrupting connectivity for every user and service behind it. No fixed firmware has been released - the vendor did not respond to the disclosure - so every unit at firmware 3.1.7.7-171114 or earlier remains exposed, and publicly available exploit code exists, lowering the effort required to mount an attack. Leadership should treat this as an unpatched network-edge exposure that threatens site availability and could serve as a foothold for lateral movement into the internal network.
No vendor-released patch identified at time of analysis. Interim mitigations: confine the web management interface to a dedicated management VLAN or administrative network with allow-listed source addresses; disable remote/WAN administration so the device cannot be managed from the internet; ensure the management port and the /goform/formConfigFastDirectionW endpoint are never reachable from untrusted networks; enforce unique, strong administrative credentials; monitor device logs, availability, and unexpected reboots for signs of form-handler exploitation; and isolate, replace, or retire any unit that cannot be reliably segmented.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB