Cyber Posture

CVE-2025-15430

HighPublic PoC

Published: 02 January 2026

Published
02 January 2026
Modified
23 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 33.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit…

more

is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly validates the oldfilename argument in the vulnerable /goform/formFtpServerShareDirSelcet endpoint to prevent buffer overflow from crafted inputs.

SI-16 Memory Protection good match
prevent

Implements memory safeguards such as stack canaries, DEP, and ASLR to block arbitrary code execution even if the strcpy buffer overflow occurs.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of the known buffer overflow flaw in the UTT firmware, including applying patches or workarounds when available.

Security SummaryAI

CVE-2025-15430 is a buffer overflow vulnerability (CWE-119, CWE-120) in UTT 进取 512W firmware version 1.7.7-171114. The flaw resides in the strcpy function within the file /goform/formFtpServerShareDirSelcet, triggered by manipulating the oldfilename argument. Published on 2026-01-02, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

An authenticated remote attacker with low privileges can exploit this vulnerability without user interaction. By sending a crafted request, the attacker induces a buffer overflow, potentially achieving arbitrary code execution, data corruption, or denial of service with high impacts on confidentiality, integrity, and availability. A public exploit is available for use.

VulDB advisories (ctiid.339352, id.339352) and a GitHub repository document the issue, including a proof-of-concept at the POC section. The vendor was contacted early but provided no response or patches, leaving affected systems without official mitigations.

Details

CWE(s)
CWE-119CWE-120

Affected Products

utt
512w firmware
≤ 1.7.7-171114

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in web endpoint (/goform/formFtpServerShareDirSelcet) enables remote authenticated low-privilege exploitation for arbitrary code execution, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References