CVE-2025-14572
Published: 12 December 2025
Description
A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation of the argument hidcontact results in memory corruption. Remote exploitation of the attack is possible. The exploit has…
more
been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents memory corruption by enforcing validation of the 'hidcontact' argument in the /goform/formWebAuthGlobalConfig endpoint.
Implements memory protections like address space layout randomization and data execution prevention to mitigate exploitation of the CWE-119 memory corruption vulnerability.
Requires timely remediation of the specific flaw in firmware versions up to 1.7.7-171114 through patching or replacement to eliminate the vulnerability.
Security SummaryAI
CVE-2025-14572 is a memory corruption vulnerability (CWE-119) in UTT 进取 512W devices running firmware versions up to 1.7.7-171114. The flaw affects an unknown part of the /goform/formWebAuthGlobalConfig file, where manipulation of the "hidcontact" argument triggers the corruption.
Remote exploitation is possible by an attacker with low privileges (PR:L) over the network (AV:N), requiring low complexity (AC:L) and no user interaction (UI:N). The CVSS v3.1 base score of 8.8 (C:H/I:H/A:H/S:U) indicates high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution or system compromise.
Advisories from VulDB and a GitHub issue (https://github.com/alc9700jmo/CVE/issues/21) confirm the exploit has been made public. The vendor was contacted early for disclosure but provided no response, and no patches or specific mitigations are detailed in the references.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable memory corruption flaw in a public-facing web interface (/goform/formWebAuthGlobalConfig) on a network device, enabling arbitrary code execution and directly mapping to T1190: Exploit Public-Facing Application.