98
CVEs
4
Critical
80
High
0
KEV
89
PoC
84
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
80
MEDIUM
12
LOW
2
Monthly CVE Trend
Affected Products (14)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-6098 | Critical remote buffer overflow vulnerability in UTT 进取 750W network devices affecting the /goform/setSysAdm API endpoint. An unauthenticated remote attacker can exploit improper use of strcpy() in the passwd1 parameter to achieve complete system compromise (confidentiality, integrity, and availability). A public proof-of-concept exploit exists, and the vendor has not provided patches or response despite early disclosure notification. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
No patch
|
| CVE-2025-70998 | Insecure default telnet credentials in UTT HiPER 810 router firmware v1.5.0. Default credentials are publicly known, enabling unauthenticated access to the router management. PoC available. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-1162 | UTT HiPER 810 router firmware 1.7.4 has a stack buffer overflow in the /goform/setNat endpoint's strcpy function, enabling remote attackers to execute arbitrary code. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-7116 | A vulnerability classified as critical has been found in UTT 进取 750W up to 3.2.2-191225. This affects an unknown part of the file /goform/Fast_wireless_conf. The manipulation of the argument ssid leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.5% | 65 |
PoC
No patch
|
| CVE-2025-6732 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been classified as critical. This affects the function strcpy of the file /goform/setSysAdm of the component API. The manipulation of the argument passwd1 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2025-6733 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been declared as critical. This vulnerability affects the function sub_416928 of the file /goform/formConfigDnsFilterGlobal of the component API. The manipulation of the argument GroupName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2025-6734 | A vulnerability was found in UTT HiPER 840G up to 3.1.1-190328. It has been rated as critical. This issue affects the function sub_484E40 of the file /goform/formP2PLimitConfig of the component API. The manipulation of the argument except leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2025-7117 | A vulnerability classified as critical was found in UTT HiPER 840G up to 3.1.1-190328. This vulnerability affects unknown code of the file /goform/websWhiteList. The manipulation of the argument addHostFilter leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.4% | 64 |
PoC
No patch
|
| CVE-2025-7118 | A vulnerability, which was classified as critical, has been found in UTT HiPER 840G up to 3.1.1-190328. This issue affects some unknown processing of the file /goform/formPictureUrl. The manipulation of the argument importpictureurl leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2025-7570 | CVE-2025-7570 is a critical remote buffer overflow vulnerability in UTT HiPER 840G devices up to version 3.1.1-190328, affecting the /goform/aspRemoteApConfTempSend endpoint via the remoteSrcTemp parameter. An authenticated remote attacker can exploit this to achieve arbitrary code execution with high impact on confidentiality, integrity, and availability. A public exploit exists and the vendor has not responded to early disclosure, indicating active exploitation risk. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2025-7571 | A critical buffer overflow vulnerability exists in UTT HiPER 840G devices up to version 3.1.1-190328, affecting the /goform/aspApBasicConfigUrcp endpoint's Username parameter. An authenticated remote attacker can exploit this to achieve arbitrary code execution with high confidentiality, integrity, and availability impact. Public proof-of-concept code is available, and the vendor has not responded to early disclosure attempts, indicating no official patch is available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2025-14141 | A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2025-14191 | A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formP2PLimitConfig. Such manipulation of the argument except leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2026-0837 | Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows authenticated attackers to achieve full system compromise through a malicious GroupName parameter. Public exploit code exists for this vulnerability and the vendor has not released a patch despite early notification. The attack requires only network access and valid credentials, presenting significant risk to affected deployments. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0838 | Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allows authenticated attackers to achieve complete system compromise with high integrity and availability impact. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early disclosure notification. The flaw requires network access but no user interaction, making it readily exploitable in environments where administrative credentials are available or compromised. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|