UTT 520W CVE-2025-15461

Exploitation requires network reachability to the router's HTTP management interface and the ability to invoke the /goform/formTaskEdit endpoint with a manipulated selDateType parameter. Per the CVSS 4.0 vector (PR:L), some level of authenticated/privileged access to the web admin interface is required - it is not a fully unauthenticated flaw. No user interaction is needed (UI:N). Limiting factors: the attacker must be able to reach the management interface (typically LAN-side or an exposed WAN admin panel), must hold at least low-level privileges on that interface, and exploitation is confined to the affected firmware build (UTT 520W 1.7.7-180627); impact is limited to the device itself (no scope change).

Signals are mostly low-to-moderate and internally consistent. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H, base 7.4) describes a remotely reachable, low-complexity buffer overflow requiring some level of privilege (PR:L) with full confidentiality/integrity/availability impact on the device itself (SC:N/SI:N/SA:N - no scope change). EPSS is very low at 0.03% (9th percentile), indicating negligible modeled probability of widespread exploitation in the near term, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code exists (a PoC published on GitHub and referenced by NVD), which raises the practical risk for exposed or targeted devices beyond what the EPSS score alone suggests. The CWE is listed as CWE-119 (improper restriction of operations within memory buffer bounds) driven by an unbounded strcpy, consistent with the buffer-overflow description. Net: this is a credible but not high-priority issue - a real, PoC-backed memory-corruption flaw in a niche SOHO/enterprise router, tempered by low deployment footprint, low EPSS, no KEV listing, and a privilege requirement. The vendor did not respond to disclosure and no patch is referenced, so exposed devices remain unremediated, which is the main aggravating factor.

An attacker with access to the router's web management interface (the PR:L web-admin context) sends a crafted request to /goform/formTaskEdit with an oversized selDateType argument, overflowing a fixed-size buffer via the unchecked strcpy. This corrupts memory to crash the device or potentially achieve code execution on the router. Published exploit code (PoC) is available, lowering the effort to reproduce the crash.