The vulnerability arises from a buffer overflow in the strcpy function used by the /goform/ConfigExceptAli component of UTT 进取 520W firmware. The flaw allows an attacker to write beyond the bounds of the destination buffer, leading to potential arbitrary code execution, making the device susceptible to complete compromise. The weakness is classified as CWE-119 and CWE-120, reflecting improper bounds checking and classic buffer overflow issues.

The affected product is UTT 进取 520W, specifically firmware version 1.7.7-180627. Only this release is known to contain the vulnerable strcpy handler in the ConfigExceptAli endpoint.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score is reported as less than 1% suggesting a low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The description confirms that the attack can be launched remotely, and the exploit has been made public. The likely attack vector is an unauthenticated remote request targeting the vulnerable /goform/ConfigExceptAli interface, which may allow an attacker to supply oversized input and trigger the overflow.