CVE-2025-15459
Published: 05 January 2026
Summary
CVE-2025-15459 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-15459 is a buffer overflow vulnerability in the UTT 进取 520W version 1.7.7-180627, specifically affecting the strcpy function within the /goform/formUser file. The issue arises from improper handling of the passwd1 argument, allowing manipulated input to trigger the overflow. It has been assigned a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability can be exploited remotely by an attacker with low privileges, requiring network access and low attack complexity but no user interaction. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, potentially leading to full system compromise such as arbitrary code execution.
Advisories from VulDB and related GitHub repositories indicate no vendor response despite early notification, with no patches or mitigations released. A proof-of-concept exploit is publicly available, increasing the risk of active exploitation. Security practitioners should isolate or decommission affected devices where possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0909
Vulnerability details
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipulation of the argument passwd1 leads to buffer overflow. The attack may be launched remotely. The…
more
exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in remotely accessible web form (/goform/formUser) directly enables remote code execution on a public-facing network device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the passwd1 input argument to prevent buffer overflow from oversized or malformed data in the /goform/formUser endpoint.
Implements memory protections such as stack canaries, ASLR, and non-executable memory to block arbitrary code execution from the strcpy buffer overflow.
Establishes processes to identify, prioritize, and remediate the known buffer overflow flaw, including isolation or decommissioning unpatched devices.