The vulnerability is located in the strcpy routine used within the /goform/formTimeGroupConfig handler on UTT 进取 520W. An attacker can cause a stack buffer overflow by supplying a year1 argument larger than the allocated buffer. This overrun could overwrite return addresses or other control data, giving the attacker the potential to execute arbitrary code on the device. Because the overflow is directly exploitable, the primary consequence is remote code execution, thereby compromising device confidentiality, integrity, and availability. This flaw is a classic stack buffer overflow (CWE-119, CWE-120).

The flaw affects UTT 进取 520W firmware version 1.7.7-180627. No other affected product or version information is publicly available.

The CVSS score of 8.7 signals a high severity risk. The EPSS score of less than 1% indicates a currently low probability of exploitation in the wild, though an exploit has already been disclosed publicly. The description states the attack may be initiated remotely; based on the file path and context, it is inferred that the attack vector is through the device's web interface using HTTP requests. Since the vulnerability occurs without the need for authentication, any network-facing device that exposes the interface to untrusted hosts could be vulnerable. The vulnerability is not included in CISA's KEV catalog, but the lack of a vendor patch or workaround increases the exposure risk.