UTT 512W
CVE-2025-15430
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid web-admin credentials
-
DeliveryReach /goform/formFtpServerShareDirSelcet endpoint
-
ExploitSend overlong oldfilename argument
-
ExecutionOverflow fixed-size buffer via strcpy
-
ImpactCrash service or execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session to the router's web management interface (CVSS PR:L) - the /goform/formFtpServerShareDirSelcet handler is part of the FTP-server share-directory configuration, so the attacker must be able to reach and submit to that admin configuration endpoint, typically as an administrator. Exploitation is limited to devices running UTT 进取 512W firmware 1.7.7-171114 with the web/FTP-server management surface network-reachable. No fixed firmware exists (vendor unresponsive), so no patched configuration removes the flaw; limiting factors are the authentication requirement and the very small deployment base of this specific device/firmware. |
| Impact | Signals are consistent but point to a low-priority issue despite the 'High' 7.4 CVSS 4.0 base score. The vendor vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) asserts full high impact to confidentiality, integrity, and availability, but this is characteristic of VulDB-sourced buffer-overflow entries, which routinely assume worst-case code execution; for an unauthenticated-to-vendor strcpy overflow in an embedded HTTP handler, the confirmed impact is far more likely a service crash (DoS) than reliable remote code execution, so VI:H/VC:H should be treated as optimistic and unverified. EPSS is low (0.11%, 29th percentile) and there is no CISA KEV listing, indicating no observed or predicted widespread exploitation. The exploitation-maturity flag E:P (Proof-of-Concept) aligns with the input noting a publicly available exploit, but POC existence is NOT active exploitation. The one genuine mitigating factor is PR:L - the /goform FTP-server configuration endpoint requires an authenticated session, meaning an attacker must already have valid (typically admin-level) web-UI credentials. Net: a real but low-urgency flaw - public POC plus vendor non-response (unpatched) raises exposure for anyone running this exact obscure firmware, but low EPSS, no KEV, an authentication gate, and unconfirmed code-execution impact keep real-world priority low. |
| Exploit ScenarioDerived | An attacker with valid credentials to the router's web administration interface sends a crafted request to /goform/formFtpServerShareDirSelcet with an overlong 'oldfilename' parameter, overflowing a fixed-size buffer in the strcpy call and crashing or potentially hijacking the handler. A public proof-of-concept is available (GitHub, GUOTINGTING2297), lowering the effort to reproduce. Because the endpoint requires authentication (PR:L), realistic abuse is limited to insiders, credential-reuse, or default/weak-credential scenarios. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can reach the device web management interface crash or potentially execute code on the device by submitting an oversized 'oldfilename' parameter to /goform/formFtpServerShareDirSelcet. According to the CVSS 4.0 vector the attacker must already hold valid credentials (PR:L), so the flaw is a post-authentication escalation/denial-of-service vector rather than an unauthenticated remote compromise. Publicly available exploit code exists (a GitHub PoC was published alongside the disclosure) and the report indicates the vendor was contacted but never responded, so no fixed firmware has been released; EPSS is only 0.11% (29th percentile), and the overall risk is low because exploitation requires an authenticated session and the affected device/firmware combination has a very small deployment base.
Earlier versions of this analysis (1)
A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted about this disclosure and did not respond, and no fixed firmware build for the 512W supersedes 1.7.7-171114. Because there is no patched configuration that removes the flaw, the practical mitigations are administrative: restrict access to the router's web management interface so that /goform/formFtpServerShareDirSelcet cannot be reached by untrusted networks - place the management UI behind a firewall/VPN or an allow-list of administrative hosts, and disable WAN-side remote management, accepting that this blocks legitimate remote administration. Enforce strong, unique administrator credentials and change any default password, since the CVSS vector requires an authenticated session (PR:L) - this raises the bar but does not fix the overflow. If the FTP-server share-directory feature is not needed, disable the FTP server entirely so the configuration endpoint is not exercised; this is a feature trade-off rather than a memory-safety fix. Monitor vendor channels and the VulDB references (https://vuldb.com/?id.339352) for a future firmware release, and consider replacing the device with a supported platform if it must remain network-exposed. Treat any successful exploitation attempt as a potential full compromise of the device (C:H/I:H/A:H) given the public PoC code.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the FTP-server share-directory configuration handler of the UTT 进取 512W, an embedded SOHO/SMB router platform. The vulnerability class is CWE-119 (improper restriction of operations within the bounds of a memory buffer); specifically, the strcpy() call in /goform/formFtpServerShareDirSelcet copies the user-supplied 'oldfilename' argument into a fixed-size stack buffer without validating its length, so an overlong value overwrites adjacent stack memory and can corrupt the return address. This is a classic embedded-firmware pattern in which CGI/goform handlers pass HTTP parameters directly to unsafe C string functions. The CPE record (cpe:2.3:o:utt:512w_firmware:*) identifies the vulnerable artifact as the 512W firmware image itself, with the single known affected build being 1.7.7-171114 and no later fixed build published. Because the handler is part of the router's administrative web/FTP configuration surface, the CVSS 4.0 vector rates it AV:N/AC:L/PR:L/UI:N - network reachable and low complexity, but gated behind valid credentials - with high confidentiality, integrity and availability impact and no scope change, matching the independent assessment's CVSS 3.1 equivalent of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable admin endpoint with low complexity but requiring authentication (PR:L); full CIA retained to mirror vendor scoring, though H impact is optimistic for a strcpy overflow likely to cause DoS.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A high-severity stack-based buffer overflow affects the UTT 进取 512W router running firmware 1.7.7-171114, a niche network-edge device with a very small deployment footprint. Exploitation requires an attacker to already hold valid credentials and reach the web management interface, meaning the flaw is a post-authentication risk that could let an insider or a compromised account crash the device or potentially execute code. Leadership should care primarily because the vendor has not released a fix and publicly available exploit code exists, so any organization that still runs this model cannot rely on patching and must contain access to the device's management plane instead.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict web management interface access to a trusted management VLAN/ACL, enforce unique strong administrator credentials, disable the FTP share-directory feature and the /goform/formFtpServerShareDirSelcet endpoint where feasible, monitor authentication failures and abnormal HTTP requests, and plan device replacement given the vendor's reported unresponsiveness.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB