CVE-2026-1140
Remote Buffer Overflow in UTT 进取 520W strcpy Function
Publication date: 2026-01-19
Last updated on: 2026-02-04
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| utt | 520w | 1.7.7-180627 |
| utt | 520w | v3v1.7.7-180627 |
| utt | 520w_firmware | to 1.7.7-180627 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-119 | The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1140 is a critical buffer overflow vulnerability in the UTT 进取 520W device, version 1.7.7-180627. It occurs in the strcpy function within the /goform/ConfigExceptAli file, where input data is copied without verifying the size, leading to a buffer overflow. This flaw allows remote attackers to exploit the device by sending specially crafted input to cause memory corruption. [2, 3]
How can this vulnerability impact me? :
This vulnerability can be exploited remotely to compromise the confidentiality, integrity, and availability of the affected system. An attacker can cause denial-of-service (DoS) conditions or potentially execute arbitrary code, leading to system crashes or unauthorized control over the device. The exploit is easy to execute and publicly available, increasing the risk of attacks. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP requests to the endpoint /goform/ConfigExceptAli on the UTT 进取 520W device, looking for unusually long or malformed parameters that could trigger the strcpy buffer overflow. Since the exploit is publicly available, you can use proof-of-concept scripts from GitHub to test if your device is vulnerable. Specific commands are not provided in the resources, but using tools like curl or wget to send crafted HTTP requests to /goform/ConfigExceptAli and observing device behavior or crashes can help detect the vulnerability. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
No official patches or mitigations are available from the vendor. The recommended immediate step is to replace the affected UTT 进取 520W device with an alternative product. Additionally, restricting network access to the device, especially blocking remote HTTP access to /goform/ConfigExceptAli, can reduce exposure. Monitoring for exploit attempts and isolating the device from untrusted networks are also advisable. [2]