CVE-2026-2067
Published: 06 February 2026
Summary
CVE-2026-2067 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Utt 520W Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer overflow vulnerability by identifying, testing, and applying firmware patches or workarounds for the affected UTT router.
Prevents the buffer overflow by validating the size and format of the 'year1' input parameter before processing with strcpy in the web form handler.
Mitigates successful exploitation of the buffer overflow through memory protection mechanisms like stack canaries, ASLR, and non-executable memory.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in router web interface (/goform/formTimeGroupConfig) allows remote authenticated exploitation for RCE, directly enabling T1190 (Exploit Public-Facing Application).
NVD Description
A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTimeGroupConfig. The manipulation of the argument year1 leads to buffer overflow. The attack may be initiated remotely. The exploit has…
more
been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2026-2067 is a buffer overflow vulnerability in the UTT 进取 520W router running firmware version 1.7.7-180627. The issue resides in the strcpy function within the /goform/formTimeGroupConfig file, where manipulation of the year1 argument triggers the overflow. This flaw, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input), carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.
The vulnerability can be exploited remotely by an attacker with low privileges, such as an authenticated user, over the network with low complexity and no user interaction required. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, potentially leading to remote code execution, data compromise, or denial of service on the affected device.
Advisories from VulDB and related disclosures, including a public proof-of-concept on GitHub, confirm the exploit's availability but note that the vendor was contacted early without any response or patch release. No official mitigations or updates are referenced, leaving affected systems reliant on network segmentation, access controls, or firmware replacement from alternative sources if available.
The exploit has been publicly disclosed with a POC, increasing the risk of active targeting against exposed UTT 进取 520W devices. No evidence of widespread real-world exploitation is mentioned in the available data.
Details
- CWE(s)