UTT 520W
CVE-2025-15459
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend crafted POST to /goform/formUser
-
ExploitOverflow buffer via oversized passwd1 in strcpy
-
ExecutionCorrupt stack memory
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the router's HTTP web management interface and an authenticated session (PR:L) able to reach the /goform/formUser endpoint; the attacker supplies an oversized 'passwd1' parameter to overflow the strcpy destination buffer. Limiting factors: valid credentials are needed (default or weak passwords significantly lower this barrier on SOHO devices), the management interface must be reachable from the attacker's position (often LAN-only unless remote administration is enabled/exposed to WAN), and it is confined to UTT 520W firmware version 1.7.7-180627. No official patch is confirmed available, so no fixed version limits exposure. |
| Impact | This is a stack/buffer overflow (CWE-119) in the /goform/formUser handler of UTT 520W router firmware 1.7.7-180627, triggered via an unsanitized strcpy of the 'passwd1' argument. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) indicates a remotely reachable but authenticated (PR:L) flaw with full technical impact on the device. The E:P (Proof-of-Concept) exploit maturity aligns with the reference set, which links a public write-up and PoC on GitHub - so publicly available exploit code exists. However, EPSS is only 0.03% (9th percentile), and there is no CISA KEV listing, indicating no evidence of widespread automated exploitation. The signals are internally consistent: a real, disclosed, PoC-backed memory-corruption bug in a low-prevalence SOHO/enterprise router, but the authentication requirement, niche product footprint, and low EPSS place this as a moderate - not urgent - priority. The vendor did not respond to disclosure, so no official patch is confirmed available, which raises residual risk for existing deployments. |
| Exploit ScenarioDerived | An attacker with valid (or default/weak) credentials to the router's web management interface sends a crafted POST request to /goform/formUser with an oversized 'passwd1' value, overflowing the fixed buffer copied by strcpy. This can crash the device (DoS) or, on typical embedded MIPS/ARM firmware, lead to arbitrary code execution on the router. A public PoC and write-up are already available, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Sep 30, 2026
Memory corruption in the UTT 520W router firmware (version 1.7.7-180627) allows an authenticated remote attacker to overflow a stack buffer through the 'passwd1' parameter handled by /goform/formUser, which can crash the device or lead to code execution under the web server's privileges. Publicly available exploit code exists (a GitHub proof-of-concept linked from NVD), but there is no CISA KEV entry and EPSS is only 0.03% (9th percentile), indicating limited observed exploitation. The vendor was notified early and did not respond, so no vendor-released patch has been identified at time of analysis.
Earlier versions of this analysis (2)
Authenticated buffer overflow in the UTT 进取 (Jinqu) 520W router running firmware 1.7.7-180627 allows remote attackers with a valid low-privilege session to overwrite memory via an oversized passwd1 parameter sent to the /goform/formUser handler, potentially achieving full compromise of the device (CVSS 3.1 base 8.8, C:H/I:H/A:H). Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS probability is very low (0.03%, 9th percentile).
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch has been identified at time of analysis, so remediation must rely on exposure reduction until UTT publishes a fixed firmware. Immediately disable WAN-side and remote administration of the web interface so that /goform/formUser is reachable only from the LAN, and segment the management plane behind a firewall rule or management VLAN that restricts access to trusted administrator hosts; the trade-off is loss of out-of-band management and the need for on-site or VPN-based access. Replace default and weak administrative credentials with long, unique passwords, since the attack requires an authenticated session (PR:L) and the default credential is the primary barrier on SOHO devices. As a further compensating control, place the device behind a reverse proxy or WAF that enforces a maximum length on form fields such as 'passwd1' and rejects oversized POST bodies, acknowledging that this adds latency and may not be feasible on constrained router hardware; alternatively, disable or block the /goform/formUser endpoint entirely if administrative password changes are performed through another interface. Because the device is end-of-support with an unresponsive vendor, plan hardware replacement with a supported router firmware line, and monitor the VulDB references (https://vuldb.com/?id.339495, https://vuldb.com/?ctiid.339495) and the public PoC (https://github.com/cymiao1978/cve/blob/main/new/22.md) for any subsequent fix announcement.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an improper restriction of operations within the bounds of a memory buffer (CWE-119) rooted in an unbounded strcpy() call inside the /goform/formUser request handler of the UTT 520W firmware. The goform-style endpoint is part of the device's embedded HTTP web management interface, which parses form fields such as 'passwd1' and copies them into a fixed-size destination buffer without length validation; supplying a value longer than the destination overwrites adjacent stack memory, corrupting saved registers and the return path. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agree that the attack is network-reachable and low complexity but requires an authenticated session (PR:L) able to reach the management endpoint. The CPE cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:* confirms the issue is firmware-side and version-bound to the 1.7.7-180627 build rather than tied to a separate application package.
Know when 520w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Remotely reachable web endpoint (AV:N/AC:L), requires an authenticated management session (PR:L), no user interaction; classic router strcpy overflow yields full device compromise (C/I/A:H).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
5DescriptionCVE.org
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 520W router firmware version 1.7.7-180627 contains a high-severity memory corruption vulnerability that could allow remote attackers to crash devices or execute code, potentially compromising network integrity. Publicly available exploit code exists, and no vendor patch is currently available, leaving organizations with these devices exposed. Leadership should prioritize identifying and mitigating affected routers to prevent potential network breaches.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to the web management interface, disabling remote administration, network segmentation, and monitoring for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 520w Firmware
View allRemote code execution in UTT 520W firmware via stack-based buffer overflow in the /goform/formPictureUrl endpoint allows
Remote code execution in UTT 520W firmware (version 1.7.7-180627) via a stack buffer overflow in the /goform/formConfigN
Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allow
Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows
Remote code execution in UTT 520W firmware versions through 1.7.7-180627 stems from a buffer overflow in the /goform/for
Unauthenticated attackers can exploit a buffer overflow in the UTT 520W Firmware's P2P configuration function via a craf
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 through a buffer overflow in the /goform/formPoli
Remote code execution in UTT 520W firmware 1.7.7-180627 allows authenticated attackers to execute arbitrary code via a b
Remote code execution in UTT 520W firmware through a buffer overflow in the /goform/formTimeGroupConfig endpoint allows
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 via stack buffer overflow in the /goform/formIpGr
Remote code execution in UTT 520W firmware 1.7.7-180627 via a buffer overflow in the /goform/ConfigExceptAli endpoint al
Remote code execution in UTT 520W firmware 1.7.7-180627 stems from a buffer overflow in the /goform/ConfigExceptMSN endp
Exploit-DB