750w Firmware EUVD-2025-18354

This vulnerability presents critical real-world risk across multiple dimensions: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates maximum exploitability—network-accessible, low complexity, no privileges or user interaction required; (2) Public POC availability means exploitation barriers are eliminated; (3) Vendor non-responsiveness indicates no official patches will likely be released, leaving deployed systems permanently vulnerable; (4) Buffer overflow on the stack typically enables arbitrary code execution (RCE), allowing complete device takeover; (5) These devices are often part of critical infrastructure or perimeter security, making compromise high-impact; (6) EPSS score (if available from NIST) would likely be elevated due to active public disclosure and POC. Unlike high-CVSS-but-theoretical vulnerabilities, this combines maximum attack surface (unauthenticated, remote, network-accessible) with confirmed exploitability (POC public) and no vendor mitigation path. This is a genuine and immediate priority, especially for organizations operating UTT 进取 750W devices.

An attacker identifies a UTT 进取 750W device exposed to the internet (via port scanning or shodan). Without requiring any authentication, the attacker crafts an HTTP POST request to /goform/setSysAdm with a maliciously crafted 'passwd1' parameter containing >256 bytes (or device-specific buffer size) of payload including ROP gadgets or shellcode. The unsafe strcpy() copies this payload into the stack buffer, overwriting the return address. Upon function return, execution jumps to attacker-controlled code, granting remote code execution. The attacker gains root/administrative access to the device, enables persistence (backdoor installation, credential harvesting), and pivots to internal networks or modifies device configuration for surveillance/man-in-the-middle attacks. Given public POC availability, this attack requires minimal technical sophistication and can be automated for mass exploitation.