UTT 512W
CVE-2025-15090
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to web management interface
-
DeliveryCraft request to /goform/formConfigNoticeConfig
-
ExploitSend overlong 'timestart' parameter
-
ExecutionOverflow fixed-size buffer via strcpy
-
ImpactCorrupt memory for RCE or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the device's web management endpoint /goform/formConfigNoticeConfig and supplying an oversized 'timestart' argument that overflows a buffer in the strcpy call. Per the CVSS vector (PR:L), a low-privilege authenticated session on the management interface is required, which limits exploitation to attackers who already have valid (even low-level) credentials or who can reach an exposed and inadequately protected admin panel; no user interaction is needed (UI:N). The main limiting factors are this authentication prerequisite and the narrow deployment of UTT 512W devices; network reachability of the management interface (e.g., WAN-exposed admin) further determines real-world exposure. |
| Impact | This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw that nonetheless requires low-level privileges (PR:L) - i.e., an authenticated session - which meaningfully constrains opportunistic mass exploitation. Technical impact is high across all three dimensions (VC:H/VI:H/VA:H), consistent with a strcpy-based buffer overflow that can plausibly yield remote code execution or device crash. Exploit maturity is E:P (proof-of-concept), and the input confirms publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score was supplied, so there is no evidence of active, widespread exploitation. The signals are therefore consistent rather than conflicting: high technical severity paired with a privilege precondition and only PoC-level maturity. The dominant real-risk limiter is product footprint - UTT is a niche Chinese SOHO/enterprise networking vendor, so exposure is narrow. Missing data to note explicitly: no EPSS probability was provided, no KEV status (treated as not listed), and affected-version granularity comes only from the 'up to 1.7.7-171114' description and a single CPE. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to the device's web management interface sends a crafted request to /goform/formConfigNoticeConfig with an overlong 'timestart' parameter, overflowing a fixed-size buffer in the strcpy call. This can corrupt memory to crash the device or potentially execute attacker-controlled code with the web service's privileges. Public proof-of-concept exploit code exists (referenced on GitHub), lowering the effort required to reproduce the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and including 1.7.7-171114) lets an attacker who holds a valid low-privilege management session crash or potentially execute code on the device by submitting an oversized 'timestart' value to /goform/formConfigNoticeConfig, which is copied with the unbounded strcpy function. The input's CVSS vector (PR:L, UI:N) confirms authentication is required but that no user interaction is needed once a session exists, and publicly available exploit code exists - no CISA KEV entry indicates confirmed active exploitation at the time of analysis. With a CVSS 4.0 base score of 7.4 and high confidentiality, integrity, and availability impact on the device, this is a genuine but moderate-priority issue rather than a top-tier emergency, primarily limited by the authentication prerequisite, the requirement that the admin interface be reachable, and the narrow deployment base of this specific router model.
RemediationAI
No vendor-released patch was identified in the available data at the time of analysis: the CPE offers no fixed-version boundary and the reference set (VulDB IDs 338419 and the submit/CTI records) points only to the vulnerability record and the public proof-of-concept at https://github.com/cymiao1978/cve/blob/main/new/15.md, not to a firmware update. Because there is no confirmed fixed build, operators should treat compensating controls as the primary response: block or restrict access to the device's web management interface so that it is reachable only from a trusted management VLAN or specific administrative hosts, and remove any WAN-side port-forwarding, DMZ, or UPnP rule that exposes the HTTP admin panel - the trade-off is loss of remote/out-of-band administration, which should be replaced with a VPN or SSH jump host. Where possible, disable or restrict low-privilege operator accounts and enforce strong, non-default administrator credentials so that the PR:L prerequisite becomes harder to satisfy, though this only raises the bar and does not eliminate the flaw. Defensive monitoring should flag requests to /goform/formConfigNoticeConfig carrying unusually long 'timestart' values, and an inline WAF or IPS can reject such payloads or cap parameter length before they reach the device, at the cost of potential false positives on legitimate large inputs. Finally, segment these routers away from sensitive network segments so that a successful overflow yields limited lateral movement, and check https://vuldb.com/?id.338419 and the vendor's support site periodically for a firmware release that addresses the strcpy defect so it can be applied as soon as it becomes available.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect in the CWE-119 family (improper restriction of operations within the bounds of a memory buffer), specifically an unbounded string copy. The affected file path /goform/formConfigNoticeConfig indicates an embedded HTTP form handler - the '/goform/' convention is characteristic of the GoAhead/goform-style web UI used in many consumer and SMB routers - and the vulnerable routine passes the user-controlled 'timestart' form argument directly to strcpy without validating its length against the size of the destination buffer. Because strcpy continues copying until it encounters a NUL byte, a longer-than-expected 'timestart' value overwrites adjacent memory, corrupting stack data such as saved return addresses and leading to a crash (denial of service) or, with a carefully crafted payload, control-flow hijacking leading to code execution. The CPE entry cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:* denotes the firmware image itself, confirming the vulnerable code ships in the device's operating firmware rather than in a separate add-on; the wildcard version means all firmware releases at or below 1.7.7-171114 are presumed affected. The assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H aligns with a remotely reachable management endpoint that requires at least low-privilege credentials.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L) requiring an authenticated low-privilege session (PR:L); strcpy overflow plausibly yields code execution with full host impact (C/I/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
Executive ViewAI
UTT 进取 512W routers running firmware up to and including 1.7.7-171114 are exposed to an authenticated stack-based buffer overflow in their web management interface that can crash the device or potentially enable code execution, and publicly available exploit code exists. The primary organizational risk is to network availability and integrity for organizations that expose or rely on these specific routers, because exploitation requires a valid low-privilege management session and a reachable admin interface. No vendor-released patch identified at time of analysis; leadership should treat this as a moderate-priority remediation item rather than a top-tier emergency, while ensuring vulnerable devices are inventoried, management access is restricted, and vendor guidance is monitored.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the web management interface to trusted networks/VPN, disabling remote management, removing or disabling default and unnecessary low-privilege accounts, enforcing least privilege and strong authentication, segmenting affected routers from critical systems, monitoring for oversized timestart values or unusual POSTs to /goform/formConfigNoticeConfig, and replacing or retiring devices if exposure cannot be adequately contained.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB