A buffer overflow flaw exists in the UTT 进取 520W firmware 1.7.7-180627 due to an unchecked strcpy call in the /goform/formIpGroupConfig endpoint when processing the groupName argument. The overflow can corrupt adjacent memory, and based on the nature of the flaw it is inferred that this could enable remote code execution, though this exact impact is not explicitly stated in the CVE description. The vulnerability permits an attacker to craft a groupName longer than the allocated buffer, triggering the overflow.

The only impacted devices are UTT 进取 520W routers running firmware version 1.7.7-180627, with the vulnerable code exposed through the web‑interface endpoint /goform/formIpGroupConfig. No other products or firmware revisions are listed as affected.

The flaw receives a CVSS score of 8.7, indicating high severity. EPSS is below 1%, and the issue is not in the CISA KEV catalog, yet a publicly available exploit exists and can be launched from any location that can reach the device’s management interface. Because the vendor did not respond to the disclosure, the risk remains elevated until the flaw is remediated.