UTT 520W
CVE-2025-15460
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to router web UI
-
DeliverySend POST to /goform/formPptpClientConfig
-
ExploitOverflow EncryptionMode via strcpy
-
ExecutionCorrupt stack / control flow
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access (PR:L) to the UTT 520W router's web management interface, then a single crafted HTTP request to the /goform/formPptpClientConfig endpoint with an overlong EncryptionMode argument; the vulnerable code path is the PPTP client configuration handler, so the device must expose its web admin interface to the attacker (LAN or, if remote management is enabled, WAN). Limiting factors: valid credentials are needed (default/weak credentials on SOHO gear often satisfy this), the target must be the specific UTT 520W firmware 1.7.7-180627, and no vendor patch is available since the vendor did not respond to disclosure. |
| Impact | This is a classic high-CVSS-but-low-real-risk profile. The CVSS 4.0 base score of 7.4 (AV:N/AC:L/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a genuinely serious memory-corruption primitive - a strcpy-based buffer overflow reachable over the network - but the surrounding signals sharply limit priority. EPSS is only 0.03% (7th percentile), indicating negligible modeled probability of widespread exploitation, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation despite the public POC. The E:P (Proof-of-Concept) exploit-maturity marker in the vector is consistent with the referenced GitHub POC but does not equal weaponized in-the-wild use. The PR:L requirement means an attacker must already be authenticated to the router's web interface (a meaningful gate on many SOHO deployments, though such devices frequently ship with weak/default credentials). The dominant risk-limiting factor is product prevalence: UTT 进取 520W is a niche Chinese SOHO/enterprise router with a small global footprint. No conflicting signals of note - CVSS network vector aligns with the description's 'remote exploitation' claim. Net: a legitimate, publicly-exploitable overflow, but low real-world urgency outside environments that actually run this specific UTT device. |
| Exploit ScenarioDerived | An attacker with valid (or default) credentials to the UTT 520W web management interface sends a crafted POST to /goform/formPptpClientConfig with an oversized EncryptionMode parameter, overflowing a fixed stack buffer via the unbounded strcpy. This can crash the router (DoS) or, with a reliable overwrite, achieve code execution on the device. A public proof-of-concept exists (published via the referenced GitHub repository), lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Stack buffer overflow in the UTT 进取 520W router (firmware 1.7.7-180627) lets an attacker with valid web-admin credentials crash or potentially execute code on the device by sending an oversized EncryptionMode parameter to the /goform/formPptpClientConfig endpoint. Publicly available exploit code exists (a GitHub PoC walkthrough of the strcpy overflow), though EPSS is only 0.03% (7th percentile) and there is no CISA KEV listing, so real-world targeting appears minimal. The vendor was contacted about the flaw but never responded, so no official firmware fix has been identified and the model must be defended through network exposure controls and credential hygiene. This is a classic high-CVSS-but-low-real-risk profile: the assessed vector requires authenticated access (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which sharply limits opportunistic exploitation.
Earlier versions of this analysis (1)
A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch identified at time of analysis: UTT was contacted early but did not respond to the disclosure, and no fixed firmware version is documented in the references. Because the flaw is reachable through the authenticated /goform/formPptpClientConfig handler, the highest-value compensating controls are (1) disable WAN-side remote management of the router's web UI so the /goform endpoint is not reachable from the internet, accepting the operational trade-off that all admin must be done from inside the LAN; (2) replace default or weak admin credentials, since authentication (PR:L) is the main barrier to exploitation and SOHO default passwords are routinely tried; (3) if PPTP client functionality is not required, avoid configuring it and, where the firmware permits, disable the PPTP client feature entirely to remove the attack surface; (4) segment the router on an isolated management VLAN with strict ACLs limiting who can reach ports 80/443, and use a hardened firewall in front of it rather than relying on the device itself; (5) monitor the device for unexpected reboots or crashes and for HTTP requests containing long EncryptionMode values. If UTT issues firmware after this analysis, upgrade to that build immediately and re-validate the fix against the published PoC at https://github.com/cymiao1978/cve/blob/main/new/23.md. The trade-off for every workaround above is reduced manageability and continued reliance on the device only as a last-hop LAN component rather than an internet-exposed gateway.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the router's embedded web management stack, which exposes administrative configuration through the Broadcom/Realtek-style '/goform/' CGI convention. The handler /goform/formPptpClientConfig processes parameters for the device's PPTP client (VPN WAN) configuration, and it copies the user-supplied EncryptionMode value into a fixed-size stack buffer using the unbounded C library function strcpy(). Because no length check is performed before the copy, an attacker who can reach the handler can overwrite adjacent stack memory, corrupting saved registers and the return address. This is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), with the specific sub-class being a classic CWE-120 unchecked strcpy overflow. On embedded MIPS/ARM router firmware such overflows typically allow denial of service via crash/reboot, and depending on mitigations (no stack canary, no ASLR, writable stack) can be steered toward remote code execution with control of the instruction pointer. The CPE cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:* indicates the generic 520W firmware line is considered affected, with 1.7.7-180627 explicitly named in the disclosure.
Know when 520w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint with low complexity, but PR:L because the config form requires authentication; full memory-corruption impact supports C/I/A:H on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Performing a manipulation of the argument EncryptionMode results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 进取 520W router (firmware 1.7.7-180627) is affected by CVE-2025-15460, a high-severity stack buffer overflow that allows an authenticated attacker with web-admin credentials to crash the device or potentially execute code via the /goform/formPptpClientConfig endpoint. No vendor-released patch identified at time of analysis, and the vendor has not responded to outreach, leaving organizations that rely on this model for network connectivity exposed. Leadership should care because a compromised router can disrupt business operations and serve as a foothold for further intrusion, though the requirement for valid credentials and the lack of confirmed active exploitation limit opportunistic risk.
Restrict web-admin access to trusted networks, enforce strong unique credentials, disable remote management, segment routers from critical assets, monitor for oversized EncryptionMode requests to /goform/formPptpClientConfig, and consider replacing affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 520w Firmware
View allRemote code execution in UTT 520W firmware via stack-based buffer overflow in the /goform/formPictureUrl endpoint allows
Remote code execution in UTT 520W firmware (version 1.7.7-180627) via a stack buffer overflow in the /goform/formConfigN
Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allow
Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows
Remote code execution in UTT 520W firmware versions through 1.7.7-180627 stems from a buffer overflow in the /goform/for
Unauthenticated attackers can exploit a buffer overflow in the UTT 520W Firmware's P2P configuration function via a craf
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 through a buffer overflow in the /goform/formPoli
Remote code execution in UTT 520W firmware 1.7.7-180627 allows authenticated attackers to execute arbitrary code via a b
Remote code execution in UTT 520W firmware through a buffer overflow in the /goform/formTimeGroupConfig endpoint allows
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 via stack buffer overflow in the /goform/formIpGr
Remote code execution in UTT 520W firmware 1.7.7-180627 via a buffer overflow in the /goform/ConfigExceptAli endpoint al
Remote code execution in UTT 520W firmware 1.7.7-180627 stems from a buffer overflow in the /goform/ConfigExceptMSN endp
Exploit-DB