CVE-2026-1139
Published: 19 January 2026
Summary
CVE-2026-1139 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-1139 is a buffer overflow vulnerability in the UTT 进取 520W router running firmware version 1.7.7-180627. The issue resides in the strcpy function within the /goform/ConfigExceptMSN file, where improper input handling allows attackers to trigger a buffer overflow. This flaw was published on January 19, 2026, and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), mapping to CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input).
Attackers with low privileges (PR:L) can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation enables high-impact confidentiality, integrity, and availability violations, potentially leading to arbitrary code execution, data theft, or full device compromise. An exploit has been publicly disclosed and may be actively used, as the vendor was notified early but provided no response.
Advisories from VulDB (ctiid.341730, id.341730, submit.735299) and a GitHub repository (cymiao1978/cve/blob/main/new/34.md) document the vulnerability, confirm remote exploitability, and note the lack of vendor patches or mitigations. No official fixes are available, leaving affected devices exposed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3239
Vulnerability details
A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/ConfigExceptMSN. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to…
more
the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (/goform/) allows remote low-priv exploitation for RCE, directly mapping to exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely identification, reporting, and correction of system flaws like this buffer overflow vulnerability, including testing and incorporation into risk mitigation.
SI-10 mandates validation of information inputs to the vulnerable /goform/ConfigExceptMSN function, directly preventing buffer overflow triggers from improper input handling.
SI-16 implements memory protections such as address space layout randomization or stack canaries to block unauthorized code execution from buffer overflow exploitation.