CVE-2026-0836
Published: 11 January 2026
Summary
CVE-2026-0836 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-0836 is a buffer overflow vulnerability affecting the UTT 进取 520W firmware version 1.7.7-180627. The flaw occurs in the strcpy function within the /goform/formConfigFastDirectionW file, where manipulation of the ssid argument triggers the overflow. It is classified under CWE-119 and CWE-120, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Remote attackers with low privileges can exploit this vulnerability over the network with low complexity and no user interaction. Successful exploitation enables high-impact consequences, including unauthorized access to confidential data, modification of system integrity, and denial of service through availability disruption, potentially leading to full system compromise.
Advisories from sources like VulDB note that the exploit has been publicly disclosed via a GitHub repository and may be utilized in attacks. The vendor was contacted early regarding the issue but provided no response, and no patches or official mitigations are available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1906
Vulnerability details
A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been…
more
publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-exposed web form (/goform/) directly enables remote code execution against a public-facing application on the device.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflow by validating the ssid argument in /goform/formConfigFastDirectionW prior to using strcpy.
Implements memory protections like stack canaries, ASLR, and DEP to block exploitation of the buffer overflow vulnerability.
Requires identification, reporting, and correction of flaws like the strcpy buffer overflow to eliminate the vulnerability.