Description
A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via buffer overflow
Action: Patch
AI Analysis

Impact

A buffer overflow occurs in the strcpy function used by the /goform/formFireWall endpoint when processing the GroupName argument. The vulnerability allows an attacker to send a specially crafted request that overflows the buffer, potentially overwriting adjacent memory and achieving arbitrary code execution.

Affected Systems

The flaw affects UTT 进取 520W, specifically firmware version 1.7.7-180627. This flaw is present in the 520W device family and applies to any deployment of the stated firmware.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity, and the EPSS score below 1% suggests low current exploitation probability, yet a public exploit is already available. The vulnerability can be triggered remotely without authentication, and the device is not part of the CISA KEV catalog. A device exposed to the Internet or weakly protected internal network poses a significant risk of compromise, making timely remediation essential.

Generated by OpenCVE AI on April 18, 2026 at 07:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the UTT 520W firmware to the latest version that patches the strcpy buffer overflow.
  • If a firmware upgrade is unavailable, disconnect the device from external networks or place it behind a firewall that blocks access to the /goform/formFireWall endpoint.
  • Configure the device to restrict or disable the formFireWall service, or change default credentials to prevent unauthorized POST requests.

Generated by OpenCVE AI on April 18, 2026 at 07:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Jan 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Utt 520w Firmware
CPEs cpe:2.3:h:utt:520w:3.0:*:*:*:*:*:*:*
cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:*
Vendors & Products Utt 520w Firmware

Mon, 12 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Utt
Utt 520w
Vendors & Products Utt
Utt 520w

Sun, 11 Jan 2026 05:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title UTT 进取 520W formFireWall strcpy buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt 520w 520w Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:29:23.448Z

Reserved: 2026-01-10T09:50:39.186Z

Link: CVE-2026-0837

cve-icon Vulnrichment

Updated: 2026-01-12T14:36:11.704Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-11T05:15:58.893

Modified: 2026-01-13T22:03:26.023

Link: CVE-2026-0837

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T07:15:25Z

Weaknesses