CVE-2025-15090

EUVD-2025-205403 · Published Dec 25, 2025

A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This vulnerability affects the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.

Technologies

Utt 512W FirmwareUtt 512W

Weaknesses

CWE-120CWE-119

CVSS scores

v4.07.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
v3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
v2.09.0AV:N/AC:L/Au:S/C:C/I:C/A:C

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

https://github.com/cymiao1978/cve/blob/main/new/15.md
https://github.com/cymiao1978/cve/blob/main/new/15.md#poc
https://vuldb.com/?ctiid.338419
https://vuldb.com/?id.338419
https://vuldb.com/?submit.708349

Potentially impacted assets

See if this affects your attack surface