CVE-2026-0839
HighSummary
A vulnerability has been identified in UTT 进取 520W version 1.7.7-180627, involving the strcpy function in the /goform/APSecurity file. Manipulating the wepkey1 argument can lead to a buffer overflow. The attack can be performed remotely, and a public exploit increases the risk of exploitation.
Risk Assessment
The organization is exposed to remote code execution or device crash, potentially causing network disruption or data integrity issues. The public exploit makes it easier for attackers to leverage this vulnerability.
Recommendation
Immediately check if the device is exposed and, if possible, disconnect it from the network or restrict remote access. Contact the vendor for a patch or workaround, and if no response, consider replacing the device with a more secure one.
Other vulnerabilities in UTT 进取 520W
See all- CVE-2026-0841High
A vulnerability was detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formPictureUrl, where manipulation of the importpictureurl argument leads to buffer overflow. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-0840High
A security vulnerability has been detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formConfigNoticeConfig, where the timestart argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
- CVE-2026-0838High
A security flaw has been discovered in UTT 进取 520W version 1.7.7-180627, affecting the strcpy function in the /goform/ConfigWirelessBase file. Manipulation of the ssid argument results in a buffer overflow. The attack can be carried out remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0837High
A vulnerability was identified in UTT 进取 520W version 1.7.7-180627 in the strcpy function of the file /goform/formFireWall. Manipulation of the GroupName argument leads to a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-0836High
A vulnerability was found in UTT 进取 520W version 1.7.7-180627, involving a buffer overflow in the strcpy function in the file /goform/formConfigFastDirectionW. Manipulation of the ssid argument causes the overflow, which can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded.
- CVE-2025-15462High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/ConfigAdvideo. Manipulation of the argument timestart leads to buffer overflow. The attack can be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15461High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formTaskEdit. Manipulation of the argument selDateType leads to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted but did not respond.
- CVE-2025-15460High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formPptpClientConfig. Manipulation of the argument EncryptionMode results in buffer overflow. Remote exploitation is possible. The exploit is now public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15459High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formUser. Manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2025-15429High
A vulnerability has been detected in UTT 进取 512W version 1.7.7-171114. The strcpy function in the file /goform/formConfigCliForEngineerOnly allows a buffer overflow via the addCommand argument. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A weakness has been identified in UTT 进取 520W 1.7.7-180627. Affected is the function strcpy of the file /goform/APSecurity. Executing a manipulation of the argument wepkey1 can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.