The vulnerability resides in the strcpy implementation used by the UTT 520W device. A remote attacker can craft a specially sized input sent to the /goform/ConfigExceptMSN interface, causing a buffer overflow. This overflow can be exploited to overwrite control data and ultimately allow code execution with the privileges of the device. The weakness is a classic unchecked buffer copy, corresponding to CWE‑119 and CWE‑120, and its impact is the potential compromise of confidentiality, integrity, and availability of the affected system.

The affected product is UTT 520W, specifically firmware version 1.7.7-180627. The device runs on a hardware platform identified as 520W with firmware release 3.0. Any installation of this firmware or earlier releases that have not been updated is vulnerable.

The CVSS base score is 8.7, indicating high severity. The EPSS score of <1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, the public‑disclosed exploit and the lack of vendor response mean that an attacker could successfully deploy this overflow from a remote network if the vulnerable interface is reachable. The attack vector is inferred to be remote network traffic to the device’s web interface, leading to a remote code execution scenario.