Cyber Posture

CVE-2026-2068

HighPublic PoC

Published: 06 February 2026

Published
06 February 2026
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/formSyslogConf. The manipulation of the argument ServerIp results in buffer overflow. The attack may be launched remotely. The exploit is now public…

more

and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely remediation of identified flaws like the buffer overflow in /goform/formSyslogConf, including patching, workarounds, or system replacement despite vendor non-response.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation of ServerIp inputs to restrict size and format, directly preventing the strcpy buffer overflow from improper input handling.

SI-16 Memory Protection good match
prevent

SI-16 provides memory protections such as DEP and ASLR that mitigate successful exploitation of the buffer overflow for code execution, data modification, or DoS.

Security SummaryAI

CVE-2026-2068 is a buffer overflow vulnerability in the UTT 进取 520W firmware version 1.7.7-180627. The issue resides in the strcpy function within the /goform/formSyslogConf component, where manipulation of the ServerIp argument triggers the overflow. This flaw is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The vulnerability enables remote exploitation by attackers who possess low privileges (PR:L) and network access to the affected device. Successful exploitation can result in high-impact consequences, including unauthorized disclosure of confidential information, modification of data or system integrity, and denial of service through availability disruption, potentially allowing arbitrary code execution.

Advisories from VulDB (ctiid.344635, id.344635) and related submissions document the issue, noting that a proof-of-concept exploit is publicly available on GitHub. The vendor was notified early but provided no response or patch, leaving affected systems without official mitigation options.

Notable context includes the public availability of the exploit, which may facilitate active use against unpatched UTT 进取 520W devices running the vulnerable firmware version.

Details

CWE(s)
CWE-119CWE-120

Affected Products

utt
520w firmware
1.7.7-180627

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Buffer overflow in web management interface (/goform/) enables remote code execution from low privileges (PR:L), directly mapping to public-facing app exploitation (T1190) and privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References