CVE-2025-10172
Published: 09 September 2025
Summary
CVE-2025-10172 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 750W Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-10172 is a buffer overflow vulnerability (CWE-119, CWE-120) in UTT 750W devices running firmware versions up to 3.2.2-191225. The flaw occurs during processing of the /goform/formPictureUrl endpoint, where manipulation of the importpictureurl argument triggers the buffer overflow condition.
The vulnerability enables remote exploitation by an attacker possessing low privileges (PR:L), with low attack complexity (AC:L) and no requirement for user interaction (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS v3.1 base score of 8.8, potentially allowing arbitrary code execution or system compromise.
Advisories from VulDB and a GitHub repository detail the issue, noting that a public exploit has been published and may be actively used. The vendor was notified early about the disclosure but provided no response, and no patches or mitigations are referenced in available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27513
Vulnerability details
A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. Executing manipulation of the argument importpictureurl can lead to buffer overflow. The attack can be executed remotely. The exploit…
more
has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public web endpoint (/goform/formPictureUrl) on network device enables remote code execution with no user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the buffer overflow by enforcing validation of the importpictureurl argument in the /goform/formPictureUrl endpoint.
Implements memory safeguards like address space layout randomization and stack canaries to prevent exploitation of the buffer overflow vulnerability.
Requires timely patching or remediation of the known buffer overflow flaw in UTT 750W firmware versions up to 3.2.2-191225.