UTT 512W
CVE-2025-15431
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend oversized filename to /goform/formFtpServerDirConfig
-
ExploitOverflow buffer via strcpy
-
ExecutionCorrupt memory / hijack control flow
-
ImpactCrash device or execute code on router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to the UTT 512W web administration interface, which must be network-reachable to the attacker; exploitation targets the FTP-server directory configuration handler (/goform/formFtpServerDirConfig) by supplying an overlong |
| Impact | Signals are mixed and lean toward a real-but-narrow risk. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H) implies a low-privilege authenticated attacker can trigger a network-reachable memory-corruption bug on the router's web management interface (/goform/formFtpServerDirConfig). A public exploit exists (POC=YES, GitHub, and Exploit Maturity E:P in the vector), which raises practical concern. However, EPSS is only 0.11% (29th percentile) and there is no CISA KEV listing, indicating no evidence of active or widespread exploitation - consistent with an obscure product unlikely to be broadly targeted. The vendor was contacted but did not respond, so no patch is expected, extending the exposure window for anyone running this device. Important caveats: this is a VulDB-sourced disclosure and the CWE-119/strcpy classification frequently manifests as a denial-of-service (crash) rather than confirmed code execution; the vendor's VC:H/VI:H/VA:H (full compromise) rating is optimistic and code-execution has not been independently verified. The PR:L requirement (authentication to the web UI) meaningfully limits the attacker population versus a fully unauthenticated flaw. |
| Exploit ScenarioDerived | An attacker with valid (or default/weak) credentials to the UTT 512W web management interface sends a crafted request to /goform/formFtpServerDirConfig with an overlong |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned attacker to corrupt memory by sending an overlong filename value to the FTP-server directory configuration handler at /goform/formFtpServerDirConfig, with high confidentiality, integrity and availability impact on the device itself. Exploitation requires valid credentials (CVSS vector PR:L) and network reachability of the web management interface, so devices with management restricted to a trusted LAN and non-default credentials are substantially harder to reach. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is low (0.11%, 29th percentile), and no vendor patch has been released because the vendor did not respond to disclosure.
Earlier versions of this analysis (1)
A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch identified at time of analysis: UTT was contacted before public disclosure and did not respond, so there is no fixed firmware version to cite and no CVE-linked vendor advisory to reference. The primary actionable steps are therefore to remove the attack surface and harden access. Restrict the web management interface to a dedicated management VLAN or trusted LAN segments with explicit ACLs, and block inbound TCP/80 and TCP/443 (and any alternate admin ports) from the WAN or untrusted networks - the trade-off is that legitimate remote administration must move to a VPN or SSH-tunneled path. Change default and shared credentials to strong, unique passwords and disable any remote-management or WAN-accessible admin options, since PR:L in the assessed vector means valid low-privilege credentials are a prerequisite; this does not remove the flaw but raises the bar and defeats default-login scanning. If the device's FTP server / shared-directory feature is not required, disable it so the /goform/formFtpServerDirConfig handler is not exercised, accepting loss of network file sharing as the cost. Where the device is end-of-support or cannot be patched or isolated, replace it with a maintained router or place it behind a compensating control that terminates and inspects HTTP requests to /goform/ endpoints. Finally, monitor management-plane logs and network traffic for anomalous or oversized requests to /goform/formFtpServerDirConfig, and treat unexpected router reboots or crashes as possible exploitation indicators; note that because the exploit is public, opportunistic scanning attempts should be expected even though EPSS is currently low and CISA KEV does not list this CVE.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded web management server of the UTT 512W, an SOHO/SMB router running firmware 1.7.7-171114 (CPE cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*, which flags the firmware line generally, though only 1.7.7-171114 is confirmed). The handler at /goform/formFtpServerDirConfig processes parameters for the device's FTP server directory configuration and passes the user-supplied filename argument into a strcpy call without validating its length. The root cause is CWE-119 (improper restriction of operations within the bounds of a memory buffer): the unbounded copy writes past the end of a fixed-size destination buffer, producing a classic stack-based buffer overflow that can overwrite adjacent stack memory. Because the vulnerable sink is reachable through an HTTP parameter on the management interface, the flaw is remotely triggerable rather than requiring physical or serial access; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P) confirms a network vector, low attack complexity, no user interaction, but low privileges required, and the independent assessment concurs with an equivalent CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Impact is confined to the device (scope unchanged), typically manifesting as memory corruption that can crash or reboot the router and, depending on stack layout and mitigations, may be leveraged for code execution in the context of the web server process.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint with AC:L, but PR:L for the authenticated management UI; high CIA reflects the vendor's asserted code-execution outcome, though DoS-only is plausible.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a manipulation of the argument filename can lead to buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 512W router, running firmware 1.7.7-171114, contains a high-severity memory-corruption flaw in its FTP-server directory configuration handler, and the vendor has not responded to disclosure, leaving no fix to deploy. Any affected device is operated by an authenticated user who can already reach the web management interface, so the practical risk is concentrated in environments where management access is exposed beyond a trusted network segment or where default or shared credentials remain in use. Leadership should care because a compromised routing device can disrupt connectivity and undermine confidence in the integrity and confidentiality of traffic it handles, and remediation depends entirely on internal compensating measures rather than a vendor update.
No vendor-released patch identified at time of analysis, and publicly available exploit code exists. Interim mitigations: restrict web management interface and the /goform/formFtpServerDirConfig endpoint to a trusted management VLAN or allowlisted administrative hosts; block internet and untrusted-VLAN reachability of the management interface; replace default and shared credentials with unique strong passwords and rotate them; disable the FTP server directory configuration feature where not required; log and alert on management authentication and configuration changes; segment affected devices so compromise cannot be used for lateral movement; plan migration to a supported router platform receiving security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB