CVE-2025-10169
Published: 09 September 2025
Summary
CVE-2025-10169 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 1200Gw Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly validates the 'ssid' argument in the /goform/ConfigWirelessBase CGI endpoint to prevent buffer overflow from malformed input.
Implements memory protections like ASLR and DEP to block unauthorized code execution even if the buffer overflow occurs.
Ensures timely remediation of the identified buffer overflow flaw through vulnerability reporting, patching, or system replacement.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing /goform/ConfigWirelessBase CGI endpoint directly enables remote code execution against the router web interface.
NVD Description
A weakness has been identified in UTT 1200GW up to 3.0.0-170831. Affected by this issue is some unknown functionality of the file /goform/ConfigWirelessBase. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit…
more
has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-10169 is a buffer overflow vulnerability (CWE-119, CWE-120) in UTT 1200GW routers running firmware up to version 3.0.0-170831. The flaw affects an unknown functionality within the /goform/ConfigWirelessBase CGI endpoint, where manipulation of the 'ssid' argument triggers the buffer overflow condition.
The vulnerability enables remote exploitation by attackers possessing low privileges (PR:L), with low attack complexity (AC:L) and no requirement for user interaction (UI:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 8.8. A public exploit is available, increasing the risk of active attacks.
VulDB advisories and a GitHub repository document the issue, including details on the endpoint and proof-of-concept exploit. The vendor was contacted early regarding disclosure but provided no response, and no patches or mitigations are available from official sources.
The exploit's public availability indicates it could be readily exploited in the wild against unpatched UTT 1200GW devices.
Details
- CWE(s)