CVE-2026-0840
Published: 11 January 2026
Summary
CVE-2026-0840 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-0840 is a buffer overflow vulnerability in the UTT 进取 520W router running firmware version 1.7.7-180627. The issue resides in the strcpy function within the /goform/formConfigNoticeConfig file, where manipulation of the 'timestart' argument triggers the overflow. This flaw, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), was published on January 11, 2026, and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user, requiring no user interaction and low attack complexity over the network. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data compromise, or denial of service on the affected device.
Advisories from VulDB note that the exploit has been publicly disclosed and is available for use, with references including a GitHub repository containing exploit details. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are mentioned in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1903
Vulnerability details
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart leads to buffer overflow. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in public-facing router web form (/goform) directly enables remote exploitation for code execution via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates inputs such as the 'timestart' argument in /goform/formConfigNoticeConfig to prevent buffer overflows from improperly sized or malformed data.
Implements memory safeguards like stack canaries, ASLR, and DEP to block arbitrary code execution even if the strcpy buffer overflow is triggered.
Requires identification, reporting, and correction of flaws like this buffer overflow in router firmware through timely patching or mitigation.