Product: UTT 进取 512W
Affected Versions: Up to 1.7.7-171114
Attack Vector: Remote (unauthenticated in most cases)
Impact: Remote Code Execution (RCE), Device Crash, Full Router Compromise
Exploit Status: Publicly disclosed, weaponizable
Patch Status: Vendor firmware update required

---

CVE-2025-15090 — Buffer Overflow via timestart

Overview

• CVE ID: CVE-2025-15090
• Severity: High
• CVSS v3.1 Score: 8.8 (High)
• Vulnerable Endpoint: /goform/formConfigNoticeConfig
• Affected Function: strcpy()
• Vulnerable Parameter: timestart
• Exploit Availability: Public
• Exploitability: Remote

Technical Details

The router firmware fails to validate the length of the timestart parameter before copying it into a fixed-length buffer using strcpy().
An attacker can submit an overly long value, overwriting adjacent memory and controlling execution flow.

Exploitation Scenario

An attacker sends a crafted HTTP POST request to the router’s web interface with a malicious timestart value.
This can result in:

• Immediate router crash (Denial of Service)
• Arbitrary code execution with system privileges

Example Payload

timestart=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

---

CVE-2025-15089 — Buffer Overflow via wepkey1

Overview

• CVE ID: CVE-2025-15089
• Severity: High
• CVSS v3.1 Score: 8.8 (High)
• Vulnerable Endpoint: /goform/APSecurity
• Affected Function: strcpy()
• Vulnerable Parameter: wepkey1
• Exploit Availability: Public
• Exploitability: Remote

Technical Details

The WEP configuration handler directly copies the wepkey1 parameter into memory without size validation.
This allows a maliciously long WEP key to overflow the buffer.

Exploitation Scenario

An attacker targets the wireless security configuration page and submits a crafted request.
Successful exploitation may lead to:

• Full device takeover
• Persistent backdoor installation

Example Payload

wepkey1=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB

---

CVE-2025-15091 — Buffer Overflow via importpictureurl

Overview

• CVE ID: CVE-2025-15091
• Severity: High
• CVSS v3.1 Score: 8.8 (High)
• Vulnerable Endpoint: /goform/formPictureUrl
• Affected Function: strcpy()
• Vulnerable Parameter: importpictureurl
• Exploit Availability: Public
• Exploitability: Remote

Technical Details

The router allows users to submit a URL for image import.
The input is copied into a fixed buffer using strcpy() without enforcing length restrictions.

Exploitation Scenario

An attacker submits an excessively long URL value, triggering a memory overwrite.
This vulnerability is especially dangerous because it can be exploited without authentication on misconfigured devices.

Example Payload

importpictureurl=http://attacker.com/AAAAAAAAAAAAAAAAAAAA

---

CVE-2025-15092 — Buffer Overflow via remark

Overview

• CVE ID: CVE-2025-15092
• Severity: High
• CVSS v3.1 Score: 8.8 (High)
• Vulnerable Endpoint: /goform/ConfigExceptMSN
• Affected Function: strcpy()
• Vulnerable Parameter: remark
• Exploit Availability: Public
• Exploitability: Remote

Technical Details

The remark field is improperly handled during configuration updates.
The use of strcpy() without bounds checking allows arbitrary-length input to corrupt memory.

Exploitation Scenario

An attacker sends a crafted POST request with a long remark value, leading to:

• Router reboot loop
• Arbitrary code execution

Example Payload

remark=CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

---

MITRE ATT&CK Mapping

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application	T1190
Execution	Command and Scripting Interpreter	T1059
Privilege Escalation	Exploitation for Privilege Escalation	T1068
Impact	Denial of Service	T1499

---

Detection & Monitoring Guidance

Indicators of Exploitation

• Unexpected router reboots
• Crashes of web management service
• Unusual POST requests with very large parameters
• Repeated access to /goform/* endpoints

Recommended Log Sources

• Router HTTP access logs
• Embedded web server error logs
• Network IDS/IPS logs
• Firewall traffic logs

---

Sample Detection Rule (Generic IDS Logic)

alert tcp any any -> router_ip 80 (
  msg:"UTT 512W Buffer Overflow Attempt";
  content:"/goform/";
  pcre:"/(timestart|wepkey1|importpictureurl|remark)=.{200,}/";
  sid:20251500;
)

---

Impact Summary

If exploited, these vulnerabilities can allow an attacker to:

• Take full control of the router
• Intercept or redirect traffic
• Deploy malware or botnet payloads
• Disrupt network availability

Because routers sit at the network perimeter, exploitation has high downstream risk.

---

Remediation & Patch Information

Official Fix

Upgrade to the latest firmware provided by UTT immediately.

• Apply only firmware obtained from the official UTT support portal
• Do not rely on configuration workarounds alone

Temporary Mitigations (If Patch Is Not Yet Applied)

• Restrict management interface access to trusted IPs
• Disable remote administration
• Place the router behind a firewall
• Monitor logs aggressively

---

Final Risk Statement

These vulnerabilities are serious, remotely exploitable, and already public.
Any exposed UTT 进取 512W router running a vulnerable firmware version should be considered at immediate risk until patched.

---