CVE-2026-0836
HighSummary
A vulnerability was found in UTT 进取 520W version 1.7.7-180627, involving a buffer overflow in the strcpy function in the file /goform/formConfigFastDirectionW. Manipulation of the ssid argument causes the overflow, which can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded.
Risk Assessment
The risk to the organization includes potential remote takeover or crash of the device, leading to network disruptions or data integrity issues. The publicly available exploit increases the likelihood of attack.
Recommendation
It is recommended to immediately restrict external access to the device and monitor traffic for exploitation attempts. Also, check if the vendor has released a firmware update or a temporary workaround.
Other vulnerabilities in UTT 进取 520W
See all- CVE-2026-0841High
A vulnerability was detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formPictureUrl, where manipulation of the importpictureurl argument leads to buffer overflow. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-0840High
A security vulnerability has been detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formConfigNoticeConfig, where the timestart argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-0839High
A vulnerability has been identified in UTT 进取 520W version 1.7.7-180627, involving the strcpy function in the /goform/APSecurity file. Manipulating the wepkey1 argument can lead to a buffer overflow. The attack can be performed remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0838High
A security flaw has been discovered in UTT 进取 520W version 1.7.7-180627, affecting the strcpy function in the /goform/ConfigWirelessBase file. Manipulation of the ssid argument results in a buffer overflow. The attack can be carried out remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0837High
A vulnerability was identified in UTT 进取 520W version 1.7.7-180627 in the strcpy function of the file /goform/formFireWall. Manipulation of the GroupName argument leads to a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2025-15462High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/ConfigAdvideo. Manipulation of the argument timestart leads to buffer overflow. The attack can be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15461High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formTaskEdit. Manipulation of the argument selDateType leads to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted but did not respond.
- CVE-2025-15460High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formPptpClientConfig. Manipulation of the argument EncryptionMode results in buffer overflow. Remote exploitation is possible. The exploit is now public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15459High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formUser. Manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2025-15429High
A vulnerability has been detected in UTT 进取 512W version 1.7.7-171114. The strcpy function in the file /goform/formConfigCliForEngineerOnly allows a buffer overflow via the addCommand argument. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.