CVE-2026-0837
HighSummary
A vulnerability was identified in UTT 进取 520W version 1.7.7-180627 in the strcpy function of the file /goform/formFireWall. Manipulation of the GroupName argument leads to a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
Risk Assessment
The organization is exposed to remote code execution or device crash, which may compromise network integrity and service availability. The publicly available exploit increases the risk of active exploitation.
Recommendation
It is recommended to immediately restrict access to the device's administrative panel (e.g., via firewall) and contact the vendor for a firmware update. If possible, disable remote access to the management interface.
Other vulnerabilities in UTT 进取 520W
See all- CVE-2026-0841High
A vulnerability was detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formPictureUrl, where manipulation of the importpictureurl argument leads to buffer overflow. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-0840High
A security vulnerability has been detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formConfigNoticeConfig, where the timestart argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-0839High
A vulnerability has been identified in UTT 进取 520W version 1.7.7-180627, involving the strcpy function in the /goform/APSecurity file. Manipulating the wepkey1 argument can lead to a buffer overflow. The attack can be performed remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0838High
A security flaw has been discovered in UTT 进取 520W version 1.7.7-180627, affecting the strcpy function in the /goform/ConfigWirelessBase file. Manipulation of the ssid argument results in a buffer overflow. The attack can be carried out remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0836High
A vulnerability was found in UTT 进取 520W version 1.7.7-180627, involving a buffer overflow in the strcpy function in the file /goform/formConfigFastDirectionW. Manipulation of the ssid argument causes the overflow, which can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded.
- CVE-2025-15462High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/ConfigAdvideo. Manipulation of the argument timestart leads to buffer overflow. The attack can be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15461High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formTaskEdit. Manipulation of the argument selDateType leads to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted but did not respond.
- CVE-2025-15460High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formPptpClientConfig. Manipulation of the argument EncryptionMode results in buffer overflow. Remote exploitation is possible. The exploit is now public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15459High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formUser. Manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2025-15429High
A vulnerability has been detected in UTT 进取 512W version 1.7.7-171114. The strcpy function in the file /goform/formConfigCliForEngineerOnly allows a buffer overflow via the addCommand argument. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formFireWall. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.