CVE-2025-10170
📋 TL;DR
A buffer overflow vulnerability in UTT 1200GW devices allows remote attackers to execute arbitrary code or cause denial of service by manipulating the loadBalanceNameOld parameter. This affects all UTT 1200GW devices running firmware versions up to 3.0.0-170831. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- UTT 1200GW
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, network infiltration, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to gain control of the device, intercept network traffic, or pivot to internal networks.
If Mitigated
Denial of service causing device reboot or instability if exploit attempts are blocked.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
No official patch is available. Contact UTT vendor for firmware updates. If unavailable, implement workarounds immediately.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to UTT 1200GW web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
VLAN Segmentation
allIsolate UTT 1200GW devices on separate VLANs with strict access controls
🧯 If You Can't Patch
- Replace affected devices with supported alternatives from different vendors
- Implement strict network segmentation and monitor all traffic to/from UTT devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface at http://device-ip/ or via SSH: cat /etc/versionCheck Version:
cat /etc/version 2>/dev/null || grep -i version /proc/cmdlineVerify Fix Applied:
Verify firmware version is above 3.0.0-170831. No official fix exists, so verification requires vendor confirmation.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /goform/formApLbConfig
- Unusual buffer overflow errors in system logs
- Device reboot events
Network Indicators:
- HTTP POST requests with long loadBalanceNameOld parameters
- Traffic to /goform/formApLbConfig from unexpected sources
SIEM Query:
source="*UTT*" AND (url="/goform/formApLbConfig" OR "loadBalanceNameOld")