UTT 512W
CVE-2025-15089
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface
-
ExploitSend oversized wepkey1 to /goform/APSecurity
-
ExecutionOverflow fixed buffer in strcpy
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to reach and authenticate to the UTT 512W router web administration interface and submit a request to the /goform/APSecurity handler with an overlong value in the 'wepkey1' parameter (the WEP/wireless-security configuration field). Limiting factors: the CVSS 4.0 PR:L metric indicates at least low-privilege authenticated access to the management interface is needed, so the attack is not viable against unauthenticated outsiders unless the admin interface is exposed with weak/default/reused credentials; the device must be the UTT 512W running firmware up to and including 1.7.7-171114; and the management interface must be network-reachable from the attacker (internal network or an internet-exposed admin port). |
| Impact | This is a moderate-priority vulnerability rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw, but PR:L means the attacker must already hold at least low-level authenticated access to the /goform/APSecurity interface, which meaningfully narrows the exploit population versus a fully unauthenticated bug. Exploitation signals are mixed: publicly available exploit code exists (referenced PoC on GitHub) and the CVSS 4.0 Exploit Maturity is E:P (Proof-of-Concept), but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active, widespread exploitation - consistent with targeted or opportunistic use at most. The high vulnerable-system impact (VC:H/VI:H/VA:H) reflects likely full device compromise typical of an embedded-router memory-corruption bug, yet the source is a single CNA (VulDB/cna@vuldb.com) with no corroborating vendor advisory, and UTT firmware CVEs of this class are frequently researcher-disclosed without confirmed in-the-wild activity. Net: real but authentication-gated, affecting a niche vendor device - prioritize for exposed/internet-facing UTT 512W units, de-prioritize where management interfaces are not reachable by untrusted users. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the UTT 512W web management interface sends a crafted request to /goform/APSecurity with an over-long 'wepkey1' parameter, overflowing a fixed-size buffer copied via strcpy. Public exploit code for this flaw already exists, lowering the effort to reproduce it. The overflow can crash the device or, if the overwrite is controllable, lead to arbitrary code execution on the router. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer overflow in the /goform/APSecurity handler by submitting an overlong value in the 'wepkey1' wireless-security parameter, corrupting memory and potentially achieving code execution with the privileges of the device's HTTP process. The flaw affects UTT 512W firmware up to and including 1.7.7-171114; the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H) confirms the attack is network-reachable but requires at least low-privilege authentication, so it is not exploitable by unauthenticated outsiders unless the admin interface is exposed with weak, default, or reused credentials. Publicly available exploit code exists (a GitHub PoC accompanies the VulDB disclosure), but there is no evidence of confirmed active exploitation (no CISA KEV listing), placing this at moderate rather than emergency priority.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed firmware version is referenced in the available intelligence, so operators must rely on compensating controls while monitoring UTT for an updated firmware image. Primary mitigations: remove the router's administrative web interface from untrusted networks - do not expose the management port to the internet, restrict access to a dedicated management VLAN or trusted source IPs via firewall ACLs, and disable WAN-side remote administration if the feature is enabled (trade-off: remote administration must be performed over a VPN or internal jump host). Second, eliminate the authentication prerequisite that the CVSS 4.0 PR:L metric requires: change default and factory credentials, enforce strong unique admin passwords, disable unused accounts, and enable any available session or login-rate restrictions (trade-off: rotation and stronger credential policies increase operational overhead and can lock out legacy management tooling). Third, if the wireless configuration workflow is not required, avoid the AP security/WEP configuration path entirely and prefer WPA2/WPA3 modes, since the vulnerable code path is reached through the 'wepkey1' WEP key field in /goform/APSecurity (trade-off: legacy clients that require WEP will no longer connect, and some firmware may force WEP configuration when a WEP SSID profile exists). Because publicly available exploit code exists at https://github.com/cymiao1978/cve/blob/main/new/14.md, treat any exposed, weakly credentialed admin interface as an active attack surface: monitor web-management logs for oversized or anomalous POST requests to /goform/APSecurity and for unexpected process restarts or reboots that may indicate failed exploitation attempts. Consult the VulDB references (https://vuldb.com/?id.338418 and https://vuldb.com/?ctiid.338418) for updates, and consider replacing the device or segmenting it behind a firewall if the firmware remains unfixed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lies in the /goform/APSecurity HTTP handler of the UTT 512W (进取 512W) router firmware, which processes wireless security configuration submitted through the administrative web interface. The parameter 'wepkey1' - a WEP key field - is passed to the C library function strcpy without any length validation before being written into a fixed-size memory buffer. Because strcpy copies until a NUL terminator is encountered, an attacker-controlled value longer than the destination buffer overwrites adjacent memory, a classic CWE-119 condition (improper restriction of operations within the bounds of a memory buffer, historically mapped to CWE-121 stack-based buffer overflow). The CPE string cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:* identifies the affected firmware as the UTT 512W firmware product line, and the disclosure notes it applies through version 1.7.7-171114. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity, and availability impact indicates the overflow is remotely triggerable over the network once a low-privileged session exists, with no user interaction and no attack-complexity or pre-condition barriers beyond authentication.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable config endpoint needing low-privilege auth (PR:L, AV:N, AC:L); buffer overflow on an embedded router plausibly yields full device compromise (C/I/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. This affects the function strcpy of the file /goform/APSecurity. The manipulation of the argument wepkey1 leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
UTT 512W routers running firmware up to and including 1.7.7-171114 contain a memory-corruption flaw in their web management interface that an authenticated user could leverage to execute code with the privileges of the device's HTTP process. Because the flaw is network-reachable and publicly available exploit code exists, any organization relying on these routers - especially where the administrative interface is internet-facing or secured only by default, weak, or reused credentials - faces an elevated risk of device compromise and potential use as a pivot into the network. No vendor patch is currently available, so leadership should treat this as a manage-through-configuration risk requiring immediate exposure reduction rather than a routine update cycle.
No vendor-released patch identified at time of analysis; interim mitigations include blocking external access to the web management interface, restricting administrative access to trusted networks or VPN, replacing default or shared credentials with unique strong passwords, and monitoring for malformed wepkey1 requests to /goform/APSecurity. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Exploit-DB