CVE-2025-14535CWE-119CWE-120

CVE-2025-14535

Critical · published December 12, 2025

CVSS v3.1
9.8
EPSS
6%
Percentile
92.9
In the wild
Unconfirmed
What it is

🔥 A remote attacker can trigger a buffer overflow just by manipulating a simple Wi-Fi SSID in UTT 进取 512W devices, potentially leading to total system control! Think of it like a delivery service that accepts a package without checking the address—an attacker can reroute the entire system to wherever they want! If exploited, this vulnerability allows attackers to crash the system or, even worse, execute arbitrary code. This means they could take over your device remotely, exposing your sensitive data or turning your router into a malicious tool. The consequences could be absolutely devastating!

Put simply

Think of it like a delivery service that accepts a package without checking the address—an attacker can reroute the entire system to wherever they want! This vulnerability occurs in the strcpy function of the /goform/formConfigFastDirectionW file, where a crafted SSID input can lead to a buffer overflow, allowing attackers to corrupt memory and run code of their choosing.

What to do

If exploited, this vulnerability allows attackers to crash the system or, even worse, execute arbitrary code. This means they could take over your device remotely, exposing your sensitive data or turning your router into a malicious tool. The consequences could be absolutely devastating! Immediate action is crucial! Users should patch their devices to version 3.1.7.8 or later. In addition, consider implementing network segmentation and monitoring to prevent unauthorized access. Don’t leave your devices vulnerable! You've got this! By addressing this vulnerability now, you'll enhance your security and keep your network safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.05630 · 92.9th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-12-12T01:15Z
Affected products (1)
ProductVersionsFixed in
utt/512w_firmware≤ 1.7.7-171114—
References (4)
EPSS history
Timeline
  • 11 DEC 19:32Z
    UTT 进取 512W formConfigFastDirectionW strcpy buffer overflow
    cvelistv5