520w Firmware EUVD-2026-19259

The CVSS score of 4.5 reflects a low-to-moderate severity rating, with several mitigating factors: the attack vector is adjacent network (AV:A), meaning an attacker must be on the same local network segment; the attack complexity is low (AC:L); but critically, the attacker requires high privileges (PR:H), limiting the practical threat to malicious administrators or highly compromised accounts. The impact is denial of service (availability loss only; confidentiality and integrity are not affected). Real-world risk is constrained because exploitation requires administrative access, local network proximity, and user interaction is not needed. This is not a critical vulnerability for most deployments unless the device is exposed to untrusted local networks or administrative interfaces. No public exploit or active exploitation has been reported, further lowering immediate risk.

A malicious network administrator or an attacker who has gained administrative credentials through phishing or credential theft gains access to the UTT Aggressive 520W management interface on the local network. The attacker uses the formFtpServerDirConfig function to submit an oversized filename parameter, triggering the buffer overflow and corrupting device memory. This causes the FTP service or the entire device to crash, resulting in denial of service. Exploitation is not complex once administrative access is obtained, but the requirement for high-privilege credentials significantly limits the practical threat surface.