UTT 512W
CVE-2025-15092
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to 512W web interface
-
DeliveryCraft request to /goform/ConfigExceptMSN
-
ExploitOverflow 'remark' buffer via strcpy
-
ExecutionCorrupt stack / hijack control flow
-
ImpactExecute code or crash router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the device's web management endpoint /goform/ConfigExceptMSN and supplying an overlong 'remark' argument; the CVSS PR:L indicates a low-privileged authenticated session (e.g., a logged-in web UI user) is needed, which is the primary limiting factor. No special non-default configuration or user interaction is required (UI:N). Realistic risk is further limited by exposure: if the router's management interface is not reachable from the attacker's network (e.g., WAN-side admin disabled), the attack surface shrinks to LAN-adjacent or authenticated users only. Affected scope is UTT 512W firmware up to and including 1.7.7-171114. |
| Impact | This is a remotely exploitable stack buffer overflow (CWE-119) in the UTT 进取 (JinQu) 512W router firmware, reached via an unsafe strcpy() on the 'remark' parameter of the /goform/ConfigExceptMSN web handler. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) indicates network-reachable, low-complexity exploitation requiring low-level authentication, with high impact to confidentiality, integrity and availability - consistent with memory-corruption-to-code-execution on an embedded device. The vector carries E:P (proof-of-concept exploit maturity), and the intelligence confirms publicly available exploit code exists; however, there is NO EPSS score and NO CISA KEV listing provided, so exploitation status is 'publicly available exploit code exists' - NOT confirmed active exploitation. The signals are internally consistent (PR:L aligns with the typical requirement of an authenticated session on a router admin interface), but the low real-world priority is driven by product prevalence rather than severity: UTT is a niche Chinese networking vendor with limited global footprint, so this reads as a genuine but narrow-blast-radius issue rather than a mass-exploitation threat. No conflicting signals were identified, though the absence of EPSS and any vendor advisory limits confidence in independently verifying affected versions and patch availability. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the 512W web management interface (or who can reach it over the network) sends a crafted request to /goform/ConfigExceptMSN with an oversized 'remark' value, overflowing the fixed-size buffer copied by strcpy() and corrupting adjacent stack memory. Given the AC:L/UI:N vector and high VC/VI/VA impact, this can crash the device or lead to arbitrary code execution on the router. Publicly available exploit code (VulDB/GitHub) lowers the barrier to weaponization, though no active exploitation has been confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7.7-171114 lets an authenticated remote attacker overflow a stack buffer by supplying an overlong 'remark' parameter, corrupting adjacent memory and potentially leading to code execution in the context of the device's web server. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network reachability, low attack complexity and high confidentiality, integrity and availability impact, but also makes clear that a low-privileged authenticated session on the web UI is required - the principal limiting factor. Publicly available exploit code exists (a GitHub write-up with a PoC under the cymiao1978/cve repository), so the barrier to reproduction is low, although no CISA KEV entry indicates confirmed active exploitation in the wild; real-world risk is dominated by whether the router's management interface is exposed beyond the trusted LAN.
RemediationAI
No vendor-released patch version was identified in the supplied data, so the primary actions are containment and exposure reduction rather than upgrading to a stated fixed release; monitor UTT/JinQu support channels and the VulDB entry (https://vuldb.com/?id.338421) for a patched 512W firmware and apply it as soon as one is published, noting that an eventual upgrade requires a maintenance window and a device reboot. Until then, disable remote/WAN-side administration so the /goform/ConfigExceptMSN endpoint is reachable only from a trusted LAN or dedicated management VLAN - this is the single most effective mitigation because the assessed PR:L requirement already means the attacker must first obtain a valid web-UI session, and removing WAN exposure eliminates the remote vector entirely (trade-off: you lose out-of-band management and must reach the device on-site or via VPN). Additionally, enforce strong unique administrator credentials and rotate any defaults to raise the authentication barrier, restrict the management UI by source IP via firewall/ACL rules, and, if a reverse proxy or WAF can be placed in front of the device, block or length-limit POST requests carrying an oversized 'remark' field to /goform/ConfigExceptMSN (trade-off: added latency and a proxy that must itself be kept patched, and it cannot protect LAN clients that reach the router directly). Finally, log and alert on POSTs to /goform/ConfigExceptMSN and on device reboots or crashes, which are the visible symptoms of a failed strcpy overflow attempt.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-119 (improper restriction of operations within the bounds of a memory buffer): the web handler behind /goform/ConfigExceptMSN copies the user-controlled 'remark' argument into a fixed-size stack buffer with strcpy() and no length validation, so a sufficiently long value overwrites stack memory including saved registers and the return address. The /goform/ URI pattern is characteristic of the lightweight embedded HTTP/GoAhead-style management daemons shipped in consumer and SMB routers, where form handlers are implemented in C and frequently rely on unsafe string functions. Per the supplied CPE (cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*) the affected component is the device firmware image itself rather than a separable library, and the wildcard version range indicates all 512W firmware builds at or below 1.7.7-171114 are presumed vulnerable. The CVSS 4.0 record (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P) and the independent CVSS 3.1 assessment agree on network vector and low-privilege authentication prerequisite, and the E:P metric corroborates the publicly reported proof-of-concept rather than confirmed in-the-wild exploitation. Only the vulnerable device itself is in scope (subsequent/system scope metrics are None), so impact is confined to the router as a foothold on the network.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web handler (AV:N/AC:L), requires a low-privilege authenticated session (PR:L), no interaction (UI:N); stack overflow yields code execution with full C/I/A impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the argument remark leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Executive ViewAI
The UTT JinQu 512W router firmware (versions up to and including 1.7.7-171114) is affected by a high-severity stack buffer overflow that allows an authenticated, low-privileged attacker with network access to the management interface to potentially execute code and fully compromise the device. Publicly available exploit code exists, lowering the barrier to exploitation, and no vendor-released patch is currently available, so organizations relying on these routers-especially those with management interfaces reachable beyond the trusted LAN-face elevated risk of network compromise or lateral movement. Leadership should prioritize identifying and isolating affected devices until a fix or mitigation is deployed.
Interim mitigations: restrict management interface to trusted LAN/VPN, disable remote/WAN management, apply firewall ACLs, enforce strong authentication, network segmentation, monitor logs for exploitation attempts, and disable unnecessary services. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB