A buffer overflow occurs in the strcpy call within /goform/formConfigNoticeConfig on UTT 进取 520W firmware 1.7.7-180627. The timestart parameter is not validated, enabling an attacker to overflow a fixed‑size buffer and corrupt memory. This can lead to remote code execution or arbitrary code injection, compromising the device’s confidentiality, integrity, and availability.

The affected product is UTT 进取 520W, specifically firmware version 1.7.7‑180627. The vulnerability resides in the formConfigNoticeConfig function and applies to all units running this firmware. The device model is the 520W hardware, and the vulnerability affects the corresponding firmware family.

The CVSS base score of 8.7 indicates high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation at present. An exploit is publicly disclosed, and the vendor has not responded to the vulnerability disclosure, leaving devices potentially unpatched. The attack vector is remote, over HTTP, and an attacker can trigger the overflow by sending a crafted timestart value to the vulnerable endpoint.