CVE-2025-13442
Published: 20 November 2025
Description
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched…
more
remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by requiring validation of the policyNames argument in the /goform/formPdbUpConfig endpoint against expected formats and values.
Enforces boundary protection to monitor and control remote network access to the vulnerable web endpoint, blocking unauthenticated exploitation attempts.
Addresses the root flaw through timely remediation, such as firmware patching or replacement, despite vendor non-response.
Security SummaryAI
CVE-2025-13442 is a command injection vulnerability affecting the UTT 进取 750W device running firmware versions up to 3.2.2-191225. The issue resides in the system function handling the /goform/formPdbUpConfig endpoint, where manipulation of the policyNames argument enables arbitrary command execution. Classified under CWE-74 and CWE-77, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its remote network accessibility and low complexity.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted requests to the affected endpoint, injecting malicious commands via the policyNames parameter. Successful exploitation allows limited impacts, including low-level confidentiality breaches (such as reading sensitive data), integrity modifications, and availability disruptions on the targeted device.
Advisories from VulDB and a related GitHub issue disclose the exploit publicly, noting it may be actively used. The vendor was notified early but has not responded or issued patches, leaving affected systems without official mitigations; practitioners should isolate devices, restrict network access to the endpoint, or seek alternative firmware if available.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote command injection via web endpoint on network device directly enables T1190 (Exploit Public-Facing Application) and facilitates arbitrary Unix shell command execution (T1059.004).