Description
A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-01-11
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution via buffer overflow
Action: Patch ASAP
AI Analysis

Impact

A buffer overflow vulnerability exists in the strcpy function used by the /goform/APSecurity endpoint of UTT 进取 520W. The flaw allows an attacker to manipulate the wepkey1 parameter and overflow a buffer, potentially leading to remote code execution. The weakness is catalogued as CWE-119 (Buffer Access with Incorrect Length Value) and CWE-120 (Buffer Copy without Length Check).

Affected Systems

The affected product is UTT 进取 520W firmware version 1.7.7-180627. The vulnerability is present in the specified build of the device firmware and could affect any unit running that firmware.

Risk and Exploitability

The CVSS score of 8.7 indicates severe impact. EPSS is reported as less than 1%, suggesting a low current exploitation probability, but a public exploit is available. The attack vector is inferred to be remote, likely over the network via the web interface, as the descriptors mention manipulation from remote. The vulnerability has not been listed in CISA's KEV catalog, but its potential for remote code execution warrants proactive mitigation.

Generated by OpenCVE AI on April 18, 2026 at 07:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the vendor website for an updated firmware release and apply the patch immediately once available.
  • Block or restrict remote access to the /goform/APSecurity endpoint using firewall rules or access control lists, limiting traffic to trusted IP addresses only.
  • If a patch is not yet available, disable web‑based configuration or WPS features to eliminate the exposed surface until a fix is deployed.

Generated by OpenCVE AI on April 18, 2026 at 07:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Jan 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Utt 520w Firmware
CPEs cpe:2.3:h:utt:520w:3.0:*:*:*:*:*:*:*
cpe:2.3:o:utt:520w_firmware:*:*:*:*:*:*:*:*
Vendors & Products Utt 520w Firmware

Mon, 12 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 12 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Utt
Utt 520w
Vendors & Products Utt
Utt 520w

Sun, 11 Jan 2026 06:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title UTT 进取 520W APSecurity strcpy buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt 520w 520w Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-02-23T08:29:48.176Z

Reserved: 2026-01-10T09:50:44.665Z

Link: CVE-2026-0839

cve-icon Vulnrichment

Updated: 2026-01-12T14:35:11.906Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-11T06:15:57.567

Modified: 2026-01-13T21:57:24.170

Link: CVE-2026-0839

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T07:15:25Z

Weaknesses