Description
A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow occurs in the strcpy function inside the /goform/formConfigFastDirectionW handler of UTT 进取 520W firmware 1.7.7-180627. The overflow is triggered by manipulating the ssid argument. The vulnerability falls under CWE-119 and CWE-120 and allows an attacker to corrupt memory, potentially leading to arbitrary code execution. The impact is a loss of confidentiality, integrity, and availability of the affected device, enabling full remote compromise.

Affected Systems

The vulnerability affects UTT 进取 520W devices running firmware version 1.7.7-180627. It corresponds to the hardware model 520W with firmware 1.7.7-180627. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, with an attacker sending a specially crafted HTTP request to the vulnerable web interface. No straightforward prerequisites are described, indicating that any network user could potentially trigger the overflow if they can reach the device.

Generated by OpenCVE AI on April 18, 2026 at 16:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a firmware update from UTT that resolves the strcpy buffer overflow in formConfigFastDirectionW
  • If an update is unavailable, restrict network access to the device, limiting exposure to trusted networks only
  • Consider disabling or restricting the web interface that exposes the vulnerable endpoint until a fix is deployed

Generated by OpenCVE AI on April 18, 2026 at 16:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Utt 520w Firmware
CPEs cpe:2.3:h:utt:520w:3.0:*:*:*:*:*:*:*
cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:*
Vendors & Products Utt 520w Firmware

Mon, 12 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Utt
Utt 520w
Vendors & Products Utt
Utt 520w

Sun, 11 Jan 2026 05:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Title UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt 520w 520w Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:29:10.612Z

Reserved: 2026-01-10T09:50:30.695Z

Link: CVE-2026-0836

cve-icon Vulnrichment

Updated: 2026-01-12T18:10:27.319Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-11T05:15:47.947

Modified: 2026-01-13T22:04:12.347

Link: CVE-2026-0836

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T16:45:05Z

Weaknesses