CVE-2025-6098
BaseFortify
Publication date: 2025-06-16
Last updated on: 2026-01-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 750w_firmware | to 5.0 (inc) |
| utt | 750w | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-6098 is a critical buffer overflow vulnerability in the UTT θΏε 750W router firmware up to version 5.0. It occurs in the API endpoint '/goform/setSysAdm' due to improper use of the 'strcpy' function when handling the 'passwd1' parameter. An attacker can send a specially crafted input to 'passwd1' that overflows the buffer on the stack, potentially causing the device to crash or behave unpredictably. This can be done remotely without any authentication. [1, 2]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to denial of service on the affected device by causing a buffer overflow. It compromises the confidentiality, integrity, and availability of the device, meaning attackers could disrupt device operation, potentially gain unauthorized control, or cause data loss. Since it is remotely exploitable without authentication, it poses a high risk to users of the affected router. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing the API endpoint '/goform/setSysAdm' for buffer overflow attempts via the 'passwd1' parameter. Since the exploit is publicly disclosed and can be triggered remotely without authentication, you can use tools like curl or custom scripts to send crafted requests to this endpoint and observe the device's behavior for crashes or denial of service. For example, a command to test might be: curl -X POST http://<device-ip>/goform/setSysAdm -d 'passwd1=AAAA...'(with a very long string to trigger overflow). Network intrusion detection systems (NIDS) can also be configured to detect unusual POST requests to this endpoint with abnormally long 'passwd1' parameters. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of the affected UTT θΏε 750W device firmware versions up to 5.0, as no patches or vendor mitigations are currently available. It is recommended to replace the affected product with an alternative device. Additionally, restricting network access to the vulnerable API endpoint by firewall rules or network segmentation can reduce exposure. Monitoring for exploit attempts and disabling remote management if possible are also advisable. [2]