CVE-2025-13442mediumCWE-74CWE-77

CVE-2025-13442: medium-severity vulnerability in UTT 进取 750W

UTT 进取 750W formPdbUpConfig system command injection

Published

Follow this CVE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 20%
In short

A web interface in UTT 进取 750W devices allows attackers to inject system commands through a form parameter called policyNames. An attacker can remotely execute arbitrary commands on the device without needing authentication.

Technical detail

CWE-74/CWE-77 command injection vulnerability in the /goform/formPdbUpConfig endpoint allows unauthenticated remote code execution via unsanitized policyNames parameter. The vulnerability affects UTT 进取 750W up to version 3.2.2-191225 and requires only network access to exploit; no authentication is required.

Summary generated and translated by AI from the official description.
A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
UTT · 进取 750W
Related CVEs — UTT 进取 750W

In the same product, most dangerous first.

CVE-2025-6098CRITICALUTT 进取 750W API setSysAdm strcpy buffer overflowEPSS 1.5%CVE-2025-7116HIGHUTT 进取 750W Fast_wireless_conf buffer overflowEPSS 1.0%CVE-2025-6097MEDIUMUTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password changeEPSS 0.7%