UTT 512W CVE-2025-14572
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted request to /goform/formWebAuthGlobalConfig
-
ExploitOverflow via hidcontact parameter
-
ExecutionCorrupt embedded web server memory
-
ImpactAchieve code execution or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the device's web management interface AND valid low-privileged authentication (CVSS PR:L), after which a crafted value in the 'hidcontact' argument of /goform/formWebAuthGlobalConfig triggers the memory corruption. Affected scope is UTT 进取 512W firmware versions up to and including 1.7.7-171114. The practical limiting factors are: the admin web interface must be reachable by the attacker (typically LAN-side, or WAN-side only if remote management is exposed), and prior authentication credentials are needed, so this is not a pre-auth drive-by against default deployments. |
| Impact | Signals are mixed and point to a real-but-niche issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) with VC:H/VI:H/VA:H yields a 7.4 (High), and the E:P (Proof-of-Concept) modifier aligns with the input flag that public exploit code exists. EPSS is only 3.47% in absolute terms (low real-world exploitation probability over 30 days), though its 89th percentile placement shows it is more concerning than most CVEs - consistent with a public PoC existing. There is NO CISA KEV listing and no SSVC decision data provided, so there is no evidence of active exploitation; this is 'publicly available exploit code exists,' not confirmed in-the-wild use. The most significant limiting factor is PR:L: per the CVSS 4.0 vector the attacker must already hold some authenticated access to the device web interface, which sharply reduces the practical remote-unauthenticated threat implied by AV:N alone. Net: a legitimate high-severity memory-corruption flaw in a low-footprint Chinese SOHO router whose vendor did not respond to disclosure, meaning no patch is expected - real priority only for the specific organizations that deploy this hardware. |
| Exploit ScenarioDerived | An attacker who already has low-privileged authenticated access to the UTT 512W web management interface sends a crafted request to /goform/formWebAuthGlobalConfig with a malicious 'hidcontact' parameter, triggering memory corruption in the embedded web server. Because a public proof-of-concept exists (GitHub issue referenced by NVD), the exact trigger is documented and reproducible, potentially leading to code execution or denial of service on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device by sending a crafted 'hidcontact' value to the /goform/formWebAuthGlobalConfig endpoint. Exploitation requires network reachability to the web management interface and valid low-privileged credentials (CVSS PR:L), and publicly available exploit code exists; the vendor did not respond to disclosure. EPSS is 3.47% (89th percentile), indicating elevated but not top-tier risk, and no vendor-fixed firmware version has been identified.
RemediationAI
No vendor-released patch identified at time of analysis; UTT was contacted early but did not respond, and no fixed firmware version is confirmed. Until a patch exists, restrict access to the web management interface: never expose it to the WAN, place it behind a VPN or management VLAN, and use firewall rules to allow only trusted administrative IPs, which may limit remote administration. If remote management is required, enforce strong unique credentials and least-privilege accounts, because exploitation requires valid low-privileged authentication; note that this does not eliminate the flaw. Monitor or block malformed requests to /goform/formWebAuthGlobalConfig, especially oversized hidcontact values, via an IPS/WAF, accepting possible false positives or management-UI breakage. Refer to VulDB https://vuldb.com/?id.336196 and the public PoC https://github.com/alc9700jmo/CVE/issues/21 for detection details, and check UTT for a future firmware update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is UTT 进取 512W router firmware, identified by CPE cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*; the endpoint /goform/formWebAuthGlobalConfig is part of the device's web-based management interface. A buffer overflow (CWE-119) occurs when the hidcontact argument is manipulated, corrupting memory. The CVSS:4.0 vector AV:N/PR:L/UI:N with VC:H/VI:H/VA:H and E:P indicates remote, authenticated exploitation with high confidentiality, integrity, and availability impact once the web interface is reachable; our independent CVSS:3.1 assessment concurs (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because PR:L is specified, authentication with at least a low-privileged account is required, not pre-auth access. The memory corruption could allow code execution or device takeover depending on exploit reliability.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L), but the formWebAuthGlobalConfig handler requires authenticated access (PR:L); memory corruption plausibly yields code execution, so C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation of the argument hidcontact results in memory corruption. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
UTT 512W routers running firmware up to 1.7.7-171114 are exposed to a memory-corruption flaw that allows an attacker holding valid low-privileged credentials to fully compromise the device through its web management interface, and no vendor-fixed firmware is available because the vendor did not respond to disclosure. Publicly available exploit code exists, so any unit reachable from untrusted networks should be treated as a credible target for full takeover, which could expose the network segment it protects. Leadership should care because these devices typically sit at the network edge, and a compromised unit can serve as a pivot point into the broader environment.
No vendor-released patch identified at time of analysis. Interim mitigations: isolate affected UTT 512W devices on a dedicated management VLAN, block internet exposure of the web management interface and the /goform/formWebAuthGlobalConfig endpoint via firewall or ACL rules, disable WAN-side administration, enforce least-privilege and rotate all device credentials, monitor for unusual admin activity, and plan hardware replacement with a supported platform.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB