1250Gw Firmware
Monthly
An authenticated buffer overflow in the UTT 1250GW gateway firmware (all builds through v2v3.2.2-200710) lets an attacker with a low-privilege session on the device's web management interface send an oversized pvid parameter to /goform/aspChangeChannel, corrupting memory on the stack via an unchecked strcpy and potentially achieving full code execution on the gateway. Exploitation is remote and low-complexity with no user interaction, but is gated by the need for prior authentication (CVSS PR:L), which is the main limiting factor. Publicly available exploit code exists on GitHub, and although the vendor was contacted early, no response or fixed firmware version has been published.
A buffer overflow in the UTT 1250GW router firmware (up to v2v3.2.2-200710) lets attackers who already hold valid low-privilege credentials crash or potentially execute code on the device by sending an oversized Username parameter to the /goform/formUserStatusRemark web endpoint over the network - no user interaction is required. Publicly available exploit code exists (a proof-of-concept was disclosed via a GitHub issue referenced by NVD), which raises the practical likelihood of exploitation, though the EPSS score of 0.75% (54th percentile) and the requirement for prior authentication indicate limited mass-exploitation urgency rather than an imminent, unauthenticated internet-wide threat. The vendor was contacted early about the disclosure but did not respond, so no vendor-released patch is identified and the exposure window remains open for anyone running the affected firmware with a reachable management interface.
A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in UTT 1250GW up to 3.2.2-200710. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authenticated buffer overflow in the UTT 1250GW gateway firmware (all builds through v2v3.2.2-200710) lets an attacker with a low-privilege session on the device's web management interface send an oversized pvid parameter to /goform/aspChangeChannel, corrupting memory on the stack via an unchecked strcpy and potentially achieving full code execution on the gateway. Exploitation is remote and low-complexity with no user interaction, but is gated by the need for prior authentication (CVSS PR:L), which is the main limiting factor. Publicly available exploit code exists on GitHub, and although the vendor was contacted early, no response or fixed firmware version has been published.
A buffer overflow in the UTT 1250GW router firmware (up to v2v3.2.2-200710) lets attackers who already hold valid low-privilege credentials crash or potentially execute code on the device by sending an oversized Username parameter to the /goform/formUserStatusRemark web endpoint over the network - no user interaction is required. Publicly available exploit code exists (a proof-of-concept was disclosed via a GitHub issue referenced by NVD), which raises the practical likelihood of exploitation, though the EPSS score of 0.75% (54th percentile) and the requirement for prior authentication indicate limited mass-exploitation urgency rather than an imminent, unauthenticated internet-wide threat. The vendor was contacted early about the disclosure but did not respond, so no vendor-released patch is identified and the exposure window remains open for anyone running the affected firmware with a reachable management interface.
A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in UTT 1250GW up to 3.2.2-200710. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.