A buffer overflow flaw exists in the strcpy call within the /goform/ConfigExceptQQ handler of UTT 进取 520W firmware 1.7.7‑180627. When an attacker sends a specially crafted request to that endpoint, the overflow can overwrite adjacent memory, enabling the levered execution of arbitrary code on the device. The weakness is categorized as CWE‑119 (improper restriction of operations performed on a buffer) and CWE‑120 (buffer copy without checking length). Such a loss of control can compromise the confidentiality, integrity, and availability of the device, and because the affected interface is reachable from external hosts, the impact extends to the entire network the device protects.

The vulnerability affects the UTT 进取 520W router, specifically firmware version 1.7.7‑180627. No other firmware revisions are listed as vulnerable. The affected product is identified by the vendor URL vendor name “UTT:进取 520W.”

The CVSS score of 8.7 marks this as a high‑severity vulnerability, and the EPSS score of <1% indicates that the likelihood of exploitation in the wild is currently low, although an exploit package has already been published. The vulnerability is not yet catalogued in the CISA KEV list. Attackers can exploit it directly from remote hosts via the web management interface, without additional access, which makes the risk significant for exposed devices. Because the vendor has not released a patch, the exposure remains for any client that continues running the affected firmware version.