Cyber Posture

CVE-2026-0840

HighPublic PoC

Published: 11 January 2026

Published
11 January 2026
Modified
13 January 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 15.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0840 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly validates inputs such as the 'timestart' argument in /goform/formConfigNoticeConfig to prevent buffer overflows from improperly sized or malformed data.

prevent

Implements memory safeguards like stack canaries, ASLR, and DEP to block arbitrary code execution even if the strcpy buffer overflow is triggered.

prevent

Requires identification, reporting, and correction of flaws like this buffer overflow in router firmware through timely patching or mitigation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Buffer overflow in public-facing router web form (/goform) directly enables remote exploitation for code execution via T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this vulnerability is the function strcpy of the file /goform/formConfigNoticeConfig. The manipulation of the argument timestart leads to buffer overflow. It is possible to initiate the attack…

more

remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-0840 is a buffer overflow vulnerability in the UTT 进取 520W router running firmware version 1.7.7-180627. The issue resides in the strcpy function within the /goform/formConfigNoticeConfig file, where manipulation of the 'timestart' argument triggers the overflow. This flaw, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), was published on January 11, 2026, and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user, requiring no user interaction and low attack complexity over the network. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially enabling arbitrary code execution, data compromise, or denial of service on the affected device.

Advisories from VulDB note that the exploit has been publicly disclosed and is available for use, with references including a GitHub repository containing exploit details. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are mentioned in the available information.

Details

CWE(s)

Affected Products

utt
520w firmware
≤ 1.7.7-180627

CVEs Like This One

CVE-2026-2067Same product: Utt 520W
CVE-2026-2066Same product: Utt 520W
CVE-2025-15460Same product: Utt 520W
CVE-2026-0837Same product: Utt 520W
CVE-2026-0841Same product: Utt 520W
CVE-2026-1139Same product: Utt 520W
CVE-2025-15462Same product: Utt 520W
CVE-2026-0839Same product: Utt 520W
CVE-2025-14141Same product: Utt 520W
CVE-2026-0836Same product: Utt 520W

References