UTT 520W
CVE-2025-15462
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to 520W web interface
-
DeliverySend crafted /goform/ConfigAdvideo request with oversized timestart
-
ExploitOverflow stack buffer via unbounded strcpy
-
ExecutionExecute code or crash device
-
ImpactFull compromise of router (C/I/A)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the HTTP management interface of a UTT 进取 520W router running firmware 1.7.7-180627, plus low-privilege authentication (PR:L) to reach the /goform/ConfigAdvideo handler. The attacker submits an overlong 'timestart' argument that is passed to an unbounded strcpy, overflowing a fixed buffer. Limiting factors: the vulnerable endpoint is behind the device management panel (not internet-facing by default on a properly segmented network), a credential/session is needed, and confirmed impact is scoped to this specific firmware build; no user interaction is required once authenticated. |
| Impact | The CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, low-complexity buffer overflow with full confidentiality/integrity/availability impact on the affected device but no scope change (SC:N/SI:N/SA:N), and the vector's E:P (Proof-of-Concept) temporal signal aligns with the input showing publicly available exploit code. Despite the 'high' base score, real-world risk is tempered sharply by multiple signals: EPSS is only 0.03% (9th percentile), the flaw is NOT in CISA KEV, and PR:L means an attacker needs some level of authentication/session on the device management interface. The single reporting source (VulDB, cna@vuldb.com) and a lone GitHub markdown 'PoC' (a research note rather than a robust weaponized exploit) indicate low-maturity disclosure typical of mass-produced SOHO router bug batches. No conflicting data, but note the vendor provided no CVSS and did not respond to disclosure, so affected-version scope beyond the single tested build (1.7.7-180627) is unverified. Net: publicly available exploit code exists, but low EPSS, no active-exploitation evidence, and the authentication prerequisite make this a low-to-moderate practical priority rather than an urgent threat - prioritize only if UTT 520W devices are exposed with reachable management. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the UTT 520W web management interface sends a crafted request to /goform/ConfigAdvideo with an oversized 'timestart' parameter, overflowing a fixed-size stack buffer via an unbounded strcpy. This corrupts device memory to crash the service or achieve code execution on the router. A proof-of-concept is publicly available on GitHub, lowering the barrier to reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
Authenticated buffer overflow in the UTT 进取 520W router running firmware 1.7.7-180627 allows remote attackers holding low-privilege credentials to corrupt memory by sending an oversized 'timestart' parameter to the /goform/ConfigAdvideo handler, which can crash the device or potentially lead to code execution. The issue is an unbounded strcpy into a fixed buffer (CWE-119) and is rated CVSS 4.0 7.4 with high confidentiality, integrity and availability impact confined to the device (no scope change). Publicly available exploit code exists on GitHub, but there is no CISA KEV confirmation of active exploitation, EPSS is low at 0.03% (9th percentile), and the vendor did not respond to disclosure, so no vendor patch has been identified at time of analysis.
Earlier versions of this analysis (1)
A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. [CVSS 8.8 HIGH]
RemediationAI
No vendor-released patch has been identified at time of analysis and UTT did not respond to the coordinated disclosure, so administrators cannot currently upgrade their way out of CVE-2025-15462 and must rely on compensating controls. The most effective is to remove the attack surface entirely: disable WAN-side/remote management and ensure the device's HTTP management interface (ports 80/443) is never reachable from untrusted networks, since the endpoint is behind the admin panel and not internet-facing by default on a properly segmented deployment - the trade-off is that administrators must manage the router from an internal jump host or VPN. Place the router's management plane on a dedicated, restricted VLAN and allow only trusted administrative IPs to reach it (ACL/firewall rules), accepting the added operational overhead of managing that segmentation; if the device must be reachable remotely, front it with a VPN rather than exposing the web UI. Enforce strong, unique administrative credentials and remove unused low-privilege accounts, because the CVSS PR:L metric shows the attacker needs only a low-privileged session to invoke /goform/ConfigAdvideo - this reduces the pool of attackers but does not eliminate the flaw. Enable logging and alerting for repeated device reboots or unusual HTTP requests to /goform/* paths as an early indicator of exploitation attempts, and plan migration to a vendor-supported router model if UTT continues to provide no maintenance for this firmware. Reference material is available at https://github.com/cymiao1978/cve/blob/main/new/25.md and the VulDB advisory pages https://vuldb.com/?id.339498 and https://vuldb.com/?ctiid.339498.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the embedded HTTP management stack of the UTT 进取 520W router, specifically the goform CGI endpoint /goform/ConfigAdvideo, which is part of the device's web-based configuration interface. The 'timestart' request parameter is copied with strcpy() into a fixed-size buffer without any length check, the classic CWE-119 'improper restriction of operations within the bounds of a memory buffer' pattern that underlies stack/heap overflow classes such as CWE-120. Because strcpy has no destination bound, an attacker controlling the parameter length controls how far past the buffer memory is overwritten, causing process crash (availability) and potentially hijacking control flow for code execution on the router's MIPS/ARM-class firmware. The CPE string cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:* identifies the affected component as the 520W firmware operating system image rather than the hardware alone, meaning remediation depends on a firmware update that the vendor has not published. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P) confirms a network-reachable, low-complexity attack requiring prior low-privilege authentication, with proof-of-concept code publicly signaled by the E:P temporal metric, while the companion CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reaches the same conclusion on prerequisites and impact.
Know when 520w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable goform endpoint (AV:N/AC:L), but the management handler requires a low-privilege session (PR:L); strcpy overflow yields full device compromise, no scope change beyond the router (S:U).
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
The UTT 进取 520W router running firmware 1.7.7-180627 - a device commonly deployed at branch, retail, and small-site edges - contains a high-severity memory-corruption flaw that an attacker holding low-privilege credentials can trigger remotely to crash the device and potentially execute code on it. Because the vendor did not respond to disclosure, no patch has been identified, so organizations running these units must manage the risk through isolation and replacement rather than patching. Leadership should treat this as an asset lifecycle and network-exposure decision: affected sites face recurring availability loss and a possible foothold on the network perimeter.
No vendor-released patch identified at time of analysis. Interim mitigations: block administrative/management access to the device from untrusted networks (especially WAN) and restrict it to dedicated management hosts; disable remote administration; remove default and unnecessary low-privilege accounts and rotate credentials, since exploitation requires valid low-privilege credentials; isolate affected routers on a segmented network segment with strict firewall/ACL rules; deploy IDS/IPS or WAF detection for oversized 'timestart' parameters sent to /goform/ConfigAdvideo and monitor for unexplained reboots or crashes; and prioritize replacement of the 520W with vendor-supported hardware given the vendor's non-response.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in 520w Firmware
View allRemote code execution in UTT 520W firmware via stack-based buffer overflow in the /goform/formPictureUrl endpoint allows
Remote code execution in UTT 520W firmware (version 1.7.7-180627) via a stack buffer overflow in the /goform/formConfigN
Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allow
Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows
Remote code execution in UTT 520W firmware versions through 1.7.7-180627 stems from a buffer overflow in the /goform/for
Unauthenticated attackers can exploit a buffer overflow in the UTT 520W Firmware's P2P configuration function via a craf
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 through a buffer overflow in the /goform/formPoli
Remote code execution in UTT 520W firmware 1.7.7-180627 allows authenticated attackers to execute arbitrary code via a b
Remote code execution in UTT 520W firmware through a buffer overflow in the /goform/formTimeGroupConfig endpoint allows
Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 via stack buffer overflow in the /goform/formIpGr
Remote code execution in UTT 520W firmware 1.7.7-180627 via a buffer overflow in the /goform/ConfigExceptAli endpoint al
Remote code execution in UTT 520W firmware 1.7.7-180627 stems from a buffer overflow in the /goform/ConfigExceptMSN endp
Exploit-DB