CVE-2026-0840
HighSummary
A security vulnerability has been detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formConfigNoticeConfig, where the timestart argument can cause a buffer overflow. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
The organization is exposed to remote code execution or device crash, potentially leading to network disruption or data integrity compromise. The publicly available exploit increases the likelihood of attacks.
Recommendation
Immediately check if the device is affected and consider disconnecting it from the network or applying temporary mitigations (e.g., network filters). Contact the vendor for a patch or workaround, as they have not responded to the disclosure.
Other vulnerabilities in UTT 进取 520W
See all- CVE-2026-0841High
A vulnerability was detected in UTT 进取 520W version 1.7.7-180627. The issue affects the strcpy function in the file /goform/formPictureUrl, where manipulation of the importpictureurl argument leads to buffer overflow. The attack can be launched remotely, and the exploit is now public.
- CVE-2026-0839High
A vulnerability has been identified in UTT 进取 520W version 1.7.7-180627, involving the strcpy function in the /goform/APSecurity file. Manipulating the wepkey1 argument can lead to a buffer overflow. The attack can be performed remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0838High
A security flaw has been discovered in UTT 进取 520W version 1.7.7-180627, affecting the strcpy function in the /goform/ConfigWirelessBase file. Manipulation of the ssid argument results in a buffer overflow. The attack can be carried out remotely, and a public exploit increases the risk of exploitation.
- CVE-2026-0837High
A vulnerability was identified in UTT 进取 520W version 1.7.7-180627 in the strcpy function of the file /goform/formFireWall. Manipulation of the GroupName argument leads to a buffer overflow. The attack can be executed remotely, and the exploit is publicly available.
- CVE-2026-0836High
A vulnerability was found in UTT 进取 520W version 1.7.7-180627, involving a buffer overflow in the strcpy function in the file /goform/formConfigFastDirectionW. Manipulation of the ssid argument causes the overflow, which can be exploited remotely. The exploit has been publicly disclosed, and the vendor has not responded.
- CVE-2025-15462High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/ConfigAdvideo. Manipulation of the argument timestart leads to buffer overflow. The attack can be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15461High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formTaskEdit. Manipulation of the argument selDateType leads to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted but did not respond.
- CVE-2025-15460High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formPptpClientConfig. Manipulation of the argument EncryptionMode results in buffer overflow. Remote exploitation is possible. The exploit is now public and may be used. The vendor was contacted but did not respond.
- CVE-2025-15459High
The UTT 进取 520W device version 1.7.7-180627 contains a buffer overflow vulnerability in the strcpy function in the file /goform/formUser. Manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted but did not respond.
- CVE-2025-15429High
A vulnerability has been detected in UTT 进取 512W version 1.7.7-171114. The strcpy function in the file /goform/formConfigCliForEngineerOnly allows a buffer overflow via the addCommand argument. The attack can be launched remotely, and the exploit is publicly available.
Original NVD description (English source)
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.