CVE-2025-11653
Published: 13 October 2025
Summary
CVE-2025-11653 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 2620G Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 49.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-11653 is a buffer overflow vulnerability affecting the UTT HiPER 2620G router in versions up to 3.1.4. The flaw exists in the strcpy function within the /goform/fNTP file, where manipulation of the NTPServerIP argument leads to the overflow. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker with low privileges and network access can exploit this vulnerability remotely without user interaction. Exploitation triggers a buffer overflow, potentially enabling high-impact consequences such as unauthorized data access, modification, or system disruption.
Advisories from VulDB and a related GitHub issue indicate that the exploit has been publicly disclosed and is available for use. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are mentioned in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33917
Vulnerability details
A vulnerability was determined in UTT HiPER 2620G up to 3.1.4. Impacted is the function strcpy of the file /goform/fNTP. This manipulation of the argument NTPServerIP causes buffer overflow. It is possible to initiate the attack remotely. The exploit has…
more
been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router's web interface (/goform/fNTP) enables remote exploitation by low-privileged attackers for code execution, directly facilitating public-facing application exploitation (T1190), exploitation of remote services (T1210), and privilege escalation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs like NTPServerIP for length and format to prevent buffer overflows from unsafe strcpy usage in /goform/fNTP.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the buffer overflow vulnerability.
Mandates identification, reporting, and timely remediation of flaws like this unpatched buffer overflow in router firmware up to version 3.1.4.