A buffer overflow occurs when the strcpy function in the formPictureUrl handler processes the importpictureurl parameter without proper bounds checking, allowing an attacker to inject arbitrary data into memory. The vulnerability involves two well‑known weaknesses, buffer overflow (CWE‑119) and unsafe string copy (CWE‑120), and can result in application crash or arbitrary code execution. Because the flaw is triggered by a remote request, an attacker can potentially exploit it from outside the network, leading to loss of confidentiality, integrity, or availability depending on the device configuration.

The affected product is UTT 进取 520W running firmware version 1.7.7‑180627. The same firmware application exposes the vulnerable endpoint on /goform/formPictureUrl. Earlier firmware releases prior to 1.7.7‑180627 may also be susceptible, but the CVE explicitly references the 1.7.7‑180627 build.

The CVSS v3.1 base score of 8.7 indicates high severity. The EPSS probability is reported as less than 1 %, suggesting low likelihood of widespread exploitation at present, but the vulnerability is publicly disclosed and the exploit exists, so the risk remains. The CVE is not yet listed in the CISA KEV catalogue. Exploitation appears to be straightforward: a remote actor sends a crafted importpictureurl value to the web interface, which triggers the vulnerable strcpy call and overwrites the stack or heap memory, potentially allowing code execution or denial of service. Successful exploitation therefore requires network access to the device’s web interface and does not necessitate additional privileges.