520w Firmware EUVD-2026-19263

The CVSS v3.1 score of 4.5 with vector AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H reflects low-to-moderate real-world risk despite the buffer overflow class. The attack vector is Adjacent Network (AV:A), requiring the attacker to be on the same local network segment, and Attack Complexity is Low. Critically, the Privileges Required field (PR:H) indicates high-privilege authentication is mandatory, meaning only administrative users can trigger the vulnerability. There is no confidentiality or integrity impact (C:N/I:N), only availability impact (A:H). EPSS data is not provided. While buffer overflows are traditionally high-risk, the combination of high privilege requirement, local network access requirement, and DoS-only impact (no remote code execution) limits the exploitability in most environments. This is a patching priority for environments where firmware administrators are considered insider threats or where the device is exposed to untrusted local networks; however, it does not pose significant risk in standard deployments with properly secured administrative access.

An authenticated administrator with high privilege access on the same local network segment connects to the UTT Aggressive 520W v3 device (via web interface or CLI) and submits a crafted, oversized payload in the addCommand parameter to the formConfigCliForEngineerOnly function. The application fails to validate input length and copies the attacker-supplied data into a fixed-size buffer, corrupting adjacent memory. The device firmware crashes or enters an unstable state, rendering the network appliance unavailable until manual intervention or reboot. A malicious insider with administrative credentials or an attacker who has compromised an administrative account could execute this attack to disrupt network services; however, the requirement for high privilege access and local network connectivity significantly limits the attack surface compared to unauthenticated remote exploits.