CVE-2025-11355
Published: 07 October 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-11355 is a buffer overflow vulnerability in UTT 1250GW routers up to version v2v3.2.2-200710. The flaw affects the strcpy function in the /goform/aspChangeChannel file, triggered by manipulation of the pvid argument. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction. Exploitation leads to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or system compromise.
Advisories from VulDB indicate that a proof-of-concept exploit has been publicly disclosed on GitHub, and the vendor was contacted early but provided no response. No patches or official mitigations are referenced.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow in router web interface (/goform/aspChangeChannel) enables remote exploitation (AV:N/PR:L) for arbitrary code execution, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).