UTT 512W
CVE-2025-15429
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid low-privilege web credentials
-
DeliveryReach /goform/formConfigCliForEngineerOnly endpoint
-
ExploitSend oversized addCommand argument
-
ExecutionOverflow fixed buffer in strcpy
-
ImpactCrash service or execute code on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (CVSS PR:L) to the UTT 进取 512W router's web management interface, then a single crafted request to the /goform/formConfigCliForEngineerOnly endpoint containing an overlong addCommand parameter. Exploitation is remote/network but gated by authentication and by the attacker being able to reach the management interface - typically LAN-side, or WAN-side only where remote management is (non-default) exposed to the internet. No user interaction is needed. No vendor fix is available, so all deployed 1.7.7-171114 firmware remains exposed to credentialed attackers. |
| Impact | Signals point to a LOW real-world priority despite a moderate 7.4 CVSS 4.0 score. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring authentication (PR:L), with full VC:H/VI:H/VA:H impact and E:P (proof-of-concept exploit maturity). Working against that severity, EPSS is only 0.04% (11th percentile), there is no CISA KEV listing, and the affected product is an obscure Chinese SOHO router with negligible enterprise footprint. A public PoC exists (GitHub, Lena-lyy), which distinguishes this from a purely theoretical bug, but PoC availability is NOT active exploitation. Note a common caveat for VulDB-sourced strcpy buffer-overflow entries: the full VC:H/VI:H/VA:H (code-execution) impact is often optimistic - many such overflows are only reliably demonstrated as a crash/DoS, and reliable remote code execution on the specific firmware is unconfirmed. The PR:L authentication gate further limits opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker who already holds valid (even low-privilege) credentials to the router's web management interface sends a crafted request to /goform/formConfigCliForEngineerOnly with an overlong addCommand argument, overflowing the fixed-size buffer copied by strcpy. A public PoC for this exact endpoint is available on GitHub, lowering the effort to reproduce a crash or attempt code execution. Because authentication is required (PR:L), the realistic attacker is a malicious/authenticated LAN user or someone leveraging default/stolen credentials on an internet-exposed management panel. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged into the web management interface to crash or potentially execute code on the device by sending a single crafted request containing an overlong addCommand parameter to /goform/formConfigCliForEngineerOnly. The flaw is a classic unchecked strcpy into a fixed-size buffer, rated 7.4 (CVSS 4.0 and our independent CVSS 3.1 assessment both agree), and it requires valid credentials (PR:L) plus network reachability to the management interface, which is normally LAN-side unless remote administration has been enabled. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no evidence of active exploitation (not in CISA KEV) and EPSS is only 0.04% (11th percentile), so this points to a low real-world priority despite the moderate score.
Earlier versions of this analysis (1)
A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCliForEngineerOnly. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch was identified at time of analysis, and the vendor did not respond to the disclosure, so operators of UTT 进取 512W units on firmware 1.7.7-171114 must rely on compensating controls. The most effective step is to keep the /goform management interface off untrusted networks: disable WAN-side remote management if it is enabled (the trade-off being loss of off-site administration, which should be replaced with VPN access) and confine the web UI to a dedicated management VLAN or a strict LAN-only firewall rule (the trade-off being that any host on that segment can still reach it). Enforce strong, unique administrative credentials and remove shared or default accounts, since the exploit requires an authenticated session and credential hygiene directly raises the bar; the trade-off is added operational overhead and help-desk load. Where an inline IPS or reverse proxy exists, deploy a rule that rejects POSTs to /goform/formConfigCliForEngineerOnly whose addCommand parameter exceeds a conservative length (for example a few hundred bytes), while accepting that such a rule is signature-based and may be bypassed by encoding tricks. Monitor router and perimeter logs for unusually long addCommand values or repeated requests to that endpoint as an indicator of attempted exploitation, and treat any crash or unexpected reboot of the router's web service as suspicious. Because no fix is available, the only fully reliable remediation is replacement of the device or migration to a vendor-supported platform, and given the 0.04% EPSS score and absence of KEV listing, these controls can be prioritized as a low-urgency hardening task rather than an emergency response.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management CGI service on the UTT 进取 512W router; the endpoint /goform/formConfigCliForEngineerOnly accepts an addCommand parameter that is passed directly into a strcpy() call without any length or bounds validation, which is the textbook pattern behind CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Because the destination is a stack-allocated fixed-size buffer in the goform handler, an oversized addCommand value overwrites adjacent memory and can corrupt control data such as a saved return address, giving an authenticated attacker a path to denial of service and potentially to arbitrary code execution in the context of the router's web service. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) both confirm that exploitation is network-reachable but gated by an authenticated session and requires no user interaction. The CPE entry cpe:2.3:o:utt:512w_firmware confirms the vulnerable asset is firmware rather than a standalone application, meaning every deployed unit still running build 1.7.7-171114 carries the same defective code path.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint, low complexity, requires low-privilege authentication (PR:L); full impact reflects claimed code execution though DoS-only is plausible.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCliForEngineerOnly. Such manipulation of the argument addCommand leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity flaw in the UTT 进取 512W router (firmware 1.7.7-171114) allows anyone with valid management credentials and network access to the device's web console to crash it or potentially run their own code on it. Because the affected management interface is normally reachable only from the local network, and no vendor fix is currently available, the practical risk is concentrated in branch and small-site deployments where the router sits on a flat internal network and default or shared admin credentials may still be in use. Leadership should care because an exploited device can take a site offline or serve as a foothold for lateral movement inside the LAN, even though current exploitation signals remain weak.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN-side administration and confine the management interface to a trusted administrative VLAN or jump host; change default and shared admin credentials and enforce unique strong passwords; apply firewall/ACL rules limiting access to the web management port; monitor and alert on router crashes, reboots, and authentication or configuration-command anomalies; maintain offline configuration backups to speed restoration; and plan hardware replacement or network-level isolation if the vendor does not deliver a fixed firmware version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB