CVE-2025-14139: medium-severity vulnerability in UTT 进取 520W
UTT 进取 520W formConfigDnsFilterGlobal strcpy buffer overflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A buffer overflow vulnerability exists in UTT 进取 520W's DNS filter configuration function. An attacker can send specially crafted input to crash the device or potentially execute unauthorized code.
The vulnerability is a classic buffer overflow in the strcpy function within the /goform/formConfigDnsFilterGlobal endpoint, triggered via the timeRangeName parameter. An unauthenticated attacker can exploit this via network access to the affected device to cause denial of service or potential code execution; the vulnerability has been publicly disclosed.
In the same product, most dangerous first.