84
CVEs
3
Critical
68
High
0
KEV
75
PoC
71
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
68
MEDIUM
11
LOW
2
Monthly CVE Trend
Affected Products (14)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-70998 | Insecure default telnet credentials in UTT HiPER 810 router firmware v1.5.0. Default credentials are publicly known, enabling unauthenticated access to the router management. PoC available. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-1162 | UTT HiPER 810 router firmware 1.7.4 has a stack buffer overflow in the /goform/setNat endpoint's strcpy function, enabling remote attackers to execute arbitrary code. | CRITICAL | 9.8 | 0.1% | 69 |
PoC
No patch
|
| CVE-2025-14141 | A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2025-14191 | A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formP2PLimitConfig. Such manipulation of the argument except leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | HIGH | 8.8 | 0.2% | 64 |
PoC
No patch
|
| CVE-2026-0837 | Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/formFireWall endpoint allows authenticated attackers to achieve full system compromise through a malicious GroupName parameter. Public exploit code exists for this vulnerability and the vendor has not released a patch despite early notification. The attack requires only network access and valid credentials, presenting significant risk to affected deployments. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0838 | Remote code execution in UTT 520W firmware 1.7.7-180627 via buffer overflow in the wireless configuration endpoint allows authenticated attackers to achieve complete system compromise with high integrity and availability impact. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early disclosure notification. The flaw requires network access but no user interaction, making it readily exploitable in environments where administrative credentials are available or compromised. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0840 | Remote code execution in UTT 520W firmware (version 1.7.7-180627) via a stack buffer overflow in the /goform/formConfigNoticeConfig endpoint allows unauthenticated attackers to execute arbitrary code with full system privileges. Public exploit code exists for this vulnerability and the vendor has not released a patch despite early notification. An attacker can trigger the overflow by manipulating the timestart parameter through a network request. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0841 | Remote code execution in UTT 520W firmware via stack-based buffer overflow in the /goform/formPictureUrl endpoint allows authenticated attackers to achieve complete system compromise. The vulnerability stems from unsafe use of strcpy() when processing the importpictureurl parameter and lacks an available patch. Public exploit code exists for this high-severity issue affecting firmware version 1.7.7-180627. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-2086 | Remote code execution in UTT HiPER 810G firmware through version 1.7.7-171114 allows authenticated attackers to achieve full system compromise via a buffer overflow in the Management Interface firewall configuration function. Public exploit code exists for this vulnerability, and no patch is available from the vendor despite early disclosure notification. The attack requires valid credentials but can be executed over the network without user interaction. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-1137 | Remote code execution in UTT 520W firmware versions through 1.7.7-180627 stems from a buffer overflow in the /goform/formWebAuthGlobalConfig endpoint, allowing authenticated attackers to execute arbitrary code with network access. Public exploit code is available for this vulnerability, and no patches have been released despite vendor notification. The high CVSS score of 8.8 reflects full compromise of confidentiality, integrity, and availability on affected devices. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-15430 | A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-15431 | A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. [CVSS 8.8 HIGH] | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0836 | Remote code execution in UTT 520W firmware versions up to 1.7.7-180627 allows authenticated attackers to execute arbitrary code through a buffer overflow in the /goform/formConfigFastDirectionW endpoint via the ssid parameter. Public exploit code exists for this vulnerability and the vendor has not released a patch despite early notification. Attackers with valid credentials can achieve complete system compromise with high impact on confidentiality, integrity, and availability. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-0839 | Remote code execution in UTT 520W Firmware 1.7.7-180627 via buffer overflow in the /goform/APSecurity endpoint allows authenticated attackers to achieve full system compromise through manipulation of the wepkey1 parameter. Public exploit code exists for this vulnerability and the vendor has not released a patch despite early notification. The high CVSS score of 8.8 reflects the critical nature of this remotely exploitable flaw affecting confidentiality, integrity, and availability. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-1138 | Buffer overflow in UTT 520W firmware version 1.7.7-180627 allows authenticated remote attackers to execute arbitrary code through the /goform/ConfigExceptQQ endpoint via unsafe string operations. Public exploit code is available and the vendor has not provided a patch despite early notification. This vulnerability affects confidentiality, integrity, and availability with CVSS 8.8 severity. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|