A buffer overflow flaw exists in the strcpy operation used to copy the GroupName parameter within the /goform/formPolicyRouteConf endpoint of UTT 进取 520W firmware. The vulnerability breaches the bounds of the buffer, allowing an attacker to write arbitrary data into adjacent memory. Because the overflow can be triggered remotely, an attacker could potentially execute arbitrary code, compromise the device’s control plane, or cause a denial‑of‑service condition. The flaw is categorized as CWE‑119 and CWE‑120 – unchecked buffer copy that overflows the target memory region.

The firmware version 1.7.7-180627 of the UTT 520W product is impacted. No other version numbers are listed in the reference data.

The CVSS score of 8.7 rates the vulnerability as high severity, and the EPSS score of less than 1% indicates a low historical exploitation probability. This vulnerability is not listed in CISA’s KEV catalog, but it has been publicly disclosed. The attack vector is inferred to be remote, leveraging the publicly accessible web management interface. Exploit complexity is low, and privileges required are none, meaning an unauthenticated attacker can trigger the overflow.