CVE-2025-11323
Published: 06 October 2025
Summary
CVE-2025-11323 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 1250Gw Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of the Username input parameter to prevent the buffer overflow triggered by unsafe strcpy usage in /goform/formUserStatusRemark.
SI-2 mandates timely flaw remediation, such as patching the buffer overflow vulnerability in the router firmware or implementing workarounds.
SI-16 enforces memory protections like stack canaries, ASLR, and DEP to mitigate remote code execution from the buffer overflow exploit.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web management interface (/goform/formUserStatusRemark) allows remote low-privilege attackers to achieve RCE, directly enabling exploitation of public-facing applications (T1190) and exploitation for privilege escalation (T1068).
NVD Description
A vulnerability was determined in UTT 1250GW up to v2v3.2.2-200710. Affected is the function strcpy of the file /goform/formUserStatusRemark. This manipulation of the argument Username causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly…
more
disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-11323 is a buffer overflow vulnerability (CWE-119, CWE-120) in the UTT 1250GW router firmware up to version v2v3.2.2-200710. The flaw affects the strcpy function in the file /goform/formUserStatusRemark, where manipulation of the Username argument triggers the overflow.
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. The CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that successful exploitation grants high impacts on confidentiality, integrity, and availability, enabling potential remote code execution.
Advisories reference a publicly disclosed exploit in a GitHub issue (https://github.com/DavCloudz/cve/issues/3) and VulDB entries (https://vuldb.com/?ctiid.327206, https://vuldb.com/?id.327206, https://vuldb.com/?submit.664524). The vendor was notified early but provided no response, and no patches or specific mitigations are detailed.
Details
- CWE(s)