UTT 512W CVE-2025-15091

Exploitation requires network reach to the 512W device's web management interface and valid low-privilege credentials (CVSS PR:L), after which the attacker sends a request to the /goform/formPictureUrl endpoint with an overlong importpictureurl argument to overflow the buffer handled by strcpy. Limiting factors: the attacker must already be authenticated at some privilege level, and the web interface must be reachable from the attacker's position (typically LAN-side unless remote administration is exposed to the WAN). No user interaction is required.

This is a memory-corruption flaw (CWE-119) in the web management interface of a niche UTT 进取 512W router, with publicly available exploit code (no KEV listing, so no confirmed active exploitation). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L - i.e., authenticated), with high impact to confidentiality, integrity, and availability but no scope change to subsequent systems. The key mitigating signal is PR:L: an attacker must first hold valid (even low-privilege) credentials to the device's web admin, which substantially narrows the realistic attacker population versus a fully unauthenticated flaw. No EPSS score or SSVC decision data was provided, so exploitation probability cannot be quantified; the only exploitation signal is the public POC referenced on GitHub. Overall this is a moderate-priority issue: a real, exploitable buffer overflow with public exploit code, but gated behind authentication and confined to a low-footprint consumer/SMB networking product - not a mass-exploitation candidate absent other evidence. EPSS is missing and should be checked before final prioritization.

An attacker with valid low-privilege credentials to the 512W web interface sends a crafted request to /goform/formPictureUrl with an oversized importpictureurl parameter, overflowing a fixed-size buffer in the strcpy call. This can crash the device (denial of service) or, with a tailored payload, corrupt memory to achieve code execution on the router. A public proof-of-concept for this attack has been disclosed on GitHub.