CVE-2025-14191
BaseFortify
Publication date: 2025-12-07
Last updated on: 2025-12-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | θΏε_512w | 1.7.7-171114 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows remote attackers to compromise the confidentiality, integrity, and availability of the affected device through a buffer overflow exploit. Such a compromise can lead to unauthorized access or disruption of services, which may result in non-compliance with standards and regulations like GDPR and HIPAA that require protection of sensitive data and system availability. However, no specific compliance impact details are provided in the resources. [2]
Can you explain this vulnerability to me?
This vulnerability is a buffer overflow issue in the strcpy function within the /goform/formP2PLimitConfig file of UTT θΏε 512W devices up to version 1.7.7-171114. It occurs when the argument to strcpy is manipulated improperly, allowing an attacker to overflow the buffer. This can be exploited remotely.
How can this vulnerability impact me? :
The vulnerability can allow a remote attacker to execute a buffer overflow attack, potentially leading to unauthorized code execution, system compromise, or denial of service on affected devices.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for requests sent to the endpoint `/goform/formP2PLimitConfig` with specially crafted input targeting the 'except' argument that triggers the buffer overflow. Network traffic analysis tools or web application firewalls can be configured to log or alert on such suspicious requests. Specific commands are not provided in the resources, but inspecting HTTP requests to this endpoint for unusual or oversized payloads could help detect exploitation attempts. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the affected UTT θΏε 512W router with a non-vulnerable device, as no vendor patches or mitigations are currently available. Additionally, restricting remote access to the device, implementing network-level filtering to block requests to `/goform/formP2PLimitConfig`, and monitoring for exploit attempts can help reduce risk. [2]