518G Firmware
Monthly
A buffer overflow in the UTT 518G router firmware (up to V3v3.2.7-210919-161313) is reachable through the authenticated web management endpoint /goform/formTaskEdit_ap, where an oversized txtMin2 argument overwrites memory and can lead to high-integrity/high-availability impact on the device, with the assessed CVSS 3.1 base score of 8.8 and the vendor-published CVSS 4.0 score of 7.4. The CVSS 4.0/3.1 vectors both carry PR:L, meaning the attacker must already hold at least low-level credentials on the router, so the practical exposure is limited to users who can log in to the web console rather than any remote unauthenticated party on the internet. Publicly available exploit code exists (linked from a GitHub PoC write-up), but there is no CISA KEV listing and EPSS is only 0.84% (56th percentile), so signals are mixed and this is a real but limited-priority issue.
Remote buffer overflow in the UTT 518G router's web management firmware (up to V3v3.2.7-210919-161313) allows an authenticated attacker to corrupt memory via a malicious Profile parameter submitted to the /goform/formRemoteControl endpoint, which is processed by the sub_4247AC function without bounds checking; successful exploitation can result in memory corruption with high impact to confidentiality, integrity and availability of the device. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the primary limiting factor is the need for at least low-privilege authenticated access plus network reachability of the management interface.
A buffer overflow in the UTT 518G router firmware (up to V3v3.2.7-210919-161313) is reachable through the authenticated web management endpoint /goform/formTaskEdit_ap, where an oversized txtMin2 argument overwrites memory and can lead to high-integrity/high-availability impact on the device, with the assessed CVSS 3.1 base score of 8.8 and the vendor-published CVSS 4.0 score of 7.4. The CVSS 4.0/3.1 vectors both carry PR:L, meaning the attacker must already hold at least low-level credentials on the router, so the practical exposure is limited to users who can log in to the web console rather than any remote unauthenticated party on the internet. Publicly available exploit code exists (linked from a GitHub PoC write-up), but there is no CISA KEV listing and EPSS is only 0.84% (56th percentile), so signals are mixed and this is a real but limited-priority issue.
Remote buffer overflow in the UTT 518G router's web management firmware (up to V3v3.2.7-210919-161313) allows an authenticated attacker to corrupt memory via a malicious Profile parameter submitted to the /goform/formRemoteControl endpoint, which is processed by the sub_4247AC function without bounds checking; successful exploitation can result in memory corruption with high impact to confidentiality, integrity and availability of the device. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the primary limiting factor is the need for at least low-privilege authenticated access plus network reachability of the management interface.