EUVD-2025-201601Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege web auth
-
DeliveryCraft overlong 'except' parameter
-
ExploitPOST to /goform/formP2PLimitConfig
-
ExecutionOverflow strcpy buffer
-
ImpactCorrupt memory / execute code on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the specific web endpoint /goform/formP2PLimitConfig on UTT 进取 512W firmware up to 1.7.7-171114, triggered by supplying an oversized value in the 'except' argument that is copied via an unbounded strcpy. The key limiting factor is authentication: the CVSS vector specifies PR:L, so the attacker must hold at least low-privilege credentials or an authenticated session to the device's management interface; no end-user interaction (UI:N) is required. Practical reach is further limited because the management interface must be network-reachable to the attacker (commonly LAN-side on SOHO routers unless remote administration is exposed), and because the product is a niche vendor appliance that is unlikely to be patched given the vendor's non-response. |
| Impact | Signals are mostly aligned toward a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.4) describes a network-reachable but authenticated (PR:L) buffer overflow with high impact to all three security properties. A public exploit exists (POC=YES) and the SSVC/threat sub-metric is E:P (Proof-of-Concept), but there is no CISA KEV listing and EPSS is only 0.16% (37th percentile), indicating no evidence of widespread active exploitation. The requirement for valid low-privilege authentication (PR:L) meaningfully constrains real-world risk despite the network attack vector. Note a vendor-behavior red flag: the reporter (VulDB) states the vendor was contacted but did not respond, so no patch is expected - an unpatched flaw with public POC in an end-of-engagement situation. Net: a real but targeted-risk issue, not an internet-wide emergency; the low EPSS combined with POC-but-no-KEV suggests opportunistic/targeted rather than mass exploitation. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to the router's web management interface sends a crafted request to /goform/formP2PLimitConfig with an overlong 'except' parameter, overflowing a fixed-size buffer via an unbounded strcpy and corrupting adjacent memory. A public proof-of-concept is already available (DavCloudz GitHub), lowering the effort to reproduce; successful exploitation can crash the device or potentially lead to code execution on the embedded firmware. Because the CVSS vector is PR:L, the attacker needs some level of valid credentials or an authenticated session rather than fully anonymous access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
An authenticated buffer overflow in the UTT 进取 512W router firmware (up to and including version 1.7.7-171114) allows a remote attacker holding valid low-privilege credentials to overwrite memory via an oversized 'except' parameter submitted to the /goform/formP2PLimitConfig web endpoint. The flaw is a classic unbounded strcpy into a fixed-size stack buffer (CWE-119), and according to the provider's CVSS v4.0 vector (7.4) it can yield high confidentiality, integrity, and availability impact on the device. Publicly available exploit code exists (a PoC is published in the DavCloudz GitHub repository), but the vulnerability is not in CISA KEV and EPSS is low at roughly 0.16% (37th percentile), so exploitation pressure is currently limited; the vendor was contacted and did not respond, so no official patch is identified.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch is identified at time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed firmware version is documented in any of the available references (VulDB 334611, EUVD-2025-201601, NVD). Because no upgrade path exists, focus on compensating controls. First, disable remote/WAN administration and keep the /goform/ management endpoints reachable only from a trusted LAN segment; this removes the AV:N exposure but does not protect against an attacker who already has LAN access or low-privilege credentials. Second, since exploitation requires PR:L, audit and rotate management credentials, remove unused accounts, and restrict who can log in to the web UI. Third, where the appliance supports it, place the 512W behind a firewall or management VLAN and block inbound access to the HTTP/HTTPS management ports from untrusted networks, accepting the trade-off that this prevents legitimate remote administration. Fourth, monitor or block requests that carry abnormally long values in the 'except' parameter to /goform/formP2PLimitConfig as a detection/containment measure, though such filtering is fragile and easily bypassed. Finally, given the vendor's non-response, treat the device as end-of-support for this issue and plan replacement or isolation; there is no confirmed upstream fix, PR, or commit to deploy (absence of patch data is not proof that none exists, but none is identified).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the web management interface of the UTT 进取 512W, a small-office/home-office router/access-point appliance running firmware up to 1.7.7-171114 (CPE cpe:2.3:o:utt:512w_firmware:*:*:*:*:*:*:*:*). The endpoint /goform/formP2PLimitConfig accepts an 'except' argument that the firmware copies into a fixed-length buffer using the unbounded strcpy() function. Because strcpy performs no length validation, an attacker-supplied string longer than the destination buffer overflows adjacent stack memory, which is the CWE-119 improper-restriction-of-operations-within-bounds-of-memory-buffer class (concretely a stack-based buffer overflow). Exploiting this typically requires crafting an HTTP request that reaches the form handler, and per the CVSS vector (PR:L) requires at least low-privilege authentication to the management interface; no user interaction (UI:N) is needed. The vulnerable function is reachable over the network (AV:N), so a LAN-side or otherwise reachable management interface exposes the attack surface. This is a niche appliance rather than a mainstream product, which reduces the likelihood of broad opportunistic scanning and of a timely vendor fix.
Know when 512w Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable web endpoint (AV:N/AC:L) requiring a low-privilege authenticated session (PR:L), no user interaction; memory-corruption overflow yields high C/I/A on the device.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formP2PLimitConfig. Such manipulation of the argument except leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
A critical remote code execution vulnerability affects UTT 进取 512W devices (versions up to 1.7.7-171114) through a buffer overflow in the P2P configuration interface. With public exploit code available and no vendor patch forthcoming, any organization using these devices faces immediate risk of unauthorized system access and potential network compromise.
Implement Web Application Firewall (WAF) rules to block requests to /goform/formP2PLimitConfig; restrict network access to administrative interfaces using firewall rules and network segmentation; disable P2P functionality if not operationally required; monitor device logs for exploit attempts; consider air-gapping affected devices or implementing reverse proxy authentication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
More in 512w Firmware
View allRemote buffer overflow in UTT 512W firmware (through 3.1.7.7-171114) allows an unauthenticated network attacker to corru
A stack-based buffer overflow in the UTT 512W router firmware (versions up to and including 3.1.7.7-171114) lets an atta
Memory corruption in UTT 512W firmware up to 1.7.7-171114 allows authenticated remote attackers to compromise the device
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned a
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can rea
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged int
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows aut
An unsafe strcpy() in the /goform/ConfigExceptMSN handler of UTT 进取 (JinQu) 512W router firmware up to and including 1.7
Authenticated buffer overflow in the UTT 进取 512W wireless router firmware (versions up to and including 1.7.7-171114) le
A stack-based buffer overflow in the web management component of UTT 进取 512W router firmware (versions up to and includi
Authenticated attackers who can reach the UTT 512W router's web management interface can trigger a strcpy-based buffer o
Exploit-DB