UTT 512W
CVE-2025-15428
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web interface (PR:L)
-
DeliverySend request to /goform/formRemoteControl
-
ExploitSupply oversized Profile argument
-
ExecutionOverflow fixed buffer via strcpy
-
ImpactCrash service or execute code on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network access to the web management interface of a UTT 进取 512W router running firmware 1.7.7-171114, plus low-privileged authentication (CVSS PR:L) to reach the /goform/formRemoteControl handler. Exploitation is performed by submitting an overly long 'Profile' argument that overflows the fixed buffer in the strcpy call. Limiting factors: the attacker must have credentials/a valid session on the admin web UI and network reachability to it (typically LAN-side unless remote management is exposed); the product is obscure and low-deployment; and no vendor patch exists (vendor unresponsive), so remediation relies on network segmentation, disabling remote management, and restricting admin access. |
| Impact | Real-world risk is low despite a 'High' 7.4 CVSS 4.0 score. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) claims network-reachable, low-complexity exploitation requiring only low privileges with full compromise of the device, but several signals pull the practical risk down. EPSS is near-floor at 0.04% (11th percentile), indicating essentially no modeled likelihood of broad exploitation, and the CVE is NOT in CISA KEV - so this is publicly available exploit code exists, not confirmed active exploitation; do not conflate the two. SSVC-style reading: exploitation is PoC-stage (vector carries E:P, Proof-of-Concept), not 'active'; the strcpy overflow is automatable in principle but the target footprint is tiny. The PR:L in the vector means this is authenticated (low-privileged), so an attacker typically needs valid/weak/default credentials to reach /goform/formRemoteControl, further limiting opportunistic mass exploitation. The VC:H/VI:H/VA:H (full-CIA) rating from VulDB is likely optimistic for a classic strcpy router overflow - such bugs frequently yield a crash/DoS rather than reliable code execution, so the confidentiality/integrity impact should be treated as unverified. Net: a credible but niche, authenticated, low-prevalence issue - not an urgent priority unless these specific UTT 512W devices are in scope. |
| Exploit ScenarioDerived | An attacker with low-privileged access to a UTT 进取 512W router's web management interface sends a crafted request to /goform/formRemoteControl with an oversized 'Profile' argument, overflowing a fixed buffer in the strcpy call. The result is at minimum a device crash (DoS) and potentially attacker-controlled code execution on the router. Public exploit/PoC code is available (GitHub Lena-lyy), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 01, 2026
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows authenticated remote attackers to crash or potentially execute code on the device by sending an oversized 'Profile' argument to /goform/formRemoteControl. Exploitation requires network reachability to the router's admin web UI plus valid low-privileged credentials (the CVSS vectors for both the NVD 4.0 score and the independent 3.1 assessment specify PR:L), and publicly available exploit code exists, though there is no evidence of active exploitation (CISA KEV does not list this CVE) and EPSS is only 0.04% (11th percentile). The vendor was contacted early but never responded, so no patch has been released, and real-world risk is low despite the 7.4 CVSS 4.0 score because the product is obscure, low-deployment, and the attack is gated behind authentication.
Earlier versions of this analysis (1)
A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch identified at time of analysis, so the primary action is to reduce exposure of the vulnerable /goform/formRemoteControl handler while planning replacement or continued isolation of the device. Disable WAN-side or remote management of the web UI and bind the admin interface to a trusted LAN or dedicated management VLAN with firewall rules/ACLs that only allow known admin hosts to reach TCP ports serving the web console; the trade-off is that legitimate remote troubleshooting becomes harder and may require VPN or jump-host access. Change any default credentials, remove unused admin accounts, and enforce least-privilege sessions because the flaw is triggered by an authenticated low-privileged user, though this does not remove the risk from an already-compromised account. Isolate the router on a separate network segment or replace it with a supported model, accepting additional infrastructure complexity and migration effort. If the device must stay in place, deploy IDS/WAF signatures that look for abnormally long 'Profile' values in requests to /goform/formRemoteControl, understanding that such signatures can cause false positives and add latency. Monitor the VulDB advisories (https://vuldb.com/?id.339350, https://vuldb.com/?ctiid.339350, https://vuldb.com/?submit.721875) and the PoC repository (https://github.com/Lena-lyy/cve/blob/main/1223/18.md) for any future vendor fix or updated mitigation guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-119 improper restriction of operations within the bounds of a memory buffer, specifically an unbounded strcpy into a fixed-size stack buffer inside the /goform/formRemoteControl handler of the UTT 512W firmware. The handler parses the HTTP 'Profile' argument and copies it into an insufficiently sized local buffer without any length check; an attacker who can reach this endpoint and is authenticated can overflow the stack, corrupting adjacent control data and potentially hijacking execution flow. The CPE entry cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:* points at the 512W firmware line, and the endpoint path follows the GoAhead-style /goform/ CGI convention widely used in embedded router web interfaces, meaning the attack surface is the device's HTTP management service. The original CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, E:P) describes an exploitable proof-of-concept with high confidentiality, integrity and availability impact at the vulnerable component, while the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agrees on remote, low-privilege, unauthenticated-network reach but authenticated-application access with full component compromise.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Authenticated low-priv access to the web UI (PR:L) over the network triggers a strcpy overflow; full CIA retained to mirror vendor scoring, though realistic impact may be DoS-only.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the argument Profile causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
Organizations using the UTT 进取 512W router model with firmware 1.7.7-171114 face a high-severity exposure in the device's administrative web interface; an attacker who already has valid low-privileged credentials and management-network access could disrupt the router or potentially take control of it. Publicly available exploit code exists, but there is no indication of active exploitation and the model is not widely deployed, so enterprise-wide business risk is limited unless this specific asset is internet- or broadly reachable. Security leadership should prioritize asset discovery and exposure reduction for this router, not broad emergency response.
No vendor-released patch identified at time of analysis; interim mitigations include isolating the UTT 进取 512W management UI behind VPN/management VLAN, blocking untrusted access to /goform/formRemoteControl, enforcing least-privilege credentials, monitoring for device crashes or anomalous processes, and planning replacement/decommissioning because the product is obscure and unpatched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB