The vulnerability arises from an unchecked strcpy operation in the formP2PLimitConfig handler, allowing an attacker to overflow a target buffer when supplying a specially crafted argument. This overflow can corrupt memory, potentially affecting confidentiality, integrity, and availability. Based on typical outcomes of buffer overflows, the resulting memory corruption could enable arbitrary code execution or lead to denial of service, but the provided description does not explicitly confirm these outcomes.

The affected product is UTT 520W router running firmware version 1.7.7-180627. Devices identified by the CNA as UTT:进取 520W with this firmware are susceptible. No other versions or builds are listed in the current data.

The CVSS score of 8.7 classifies the issue as high severity, while the EPSS score indicates a very low current exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog. However, a public exploit exists and the attack can be carried out remotely via a web request to /goform/formP2PLimitConfig, so the likelihood of attempted exploitation remains a concern for exposed devices.