CVE-2025-10172
📋 TL;DR
A buffer overflow vulnerability in UTT 750W devices up to version 3.2.2-191225 allows remote attackers to execute arbitrary code by manipulating the importpictureurl parameter in the /goform/formPictureUrl endpoint. This affects all systems running vulnerable firmware versions. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- UTT 750W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Remote code execution resulting in device takeover, network pivoting, and denial of service.
If Mitigated
Exploitation attempts blocked by network segmentation and input validation controls.
🎯 Exploit Status
Exploit details are publicly available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider replacing affected devices with alternative solutions or implementing strict network controls.
🔧 Temporary Workarounds
Network Segmentation
allIsolate UTT 750W devices from untrusted networks and restrict access to management interfaces.
Web Application Firewall
allDeploy WAF rules to block requests containing suspicious patterns targeting /goform/formPictureUrl with manipulated importpictureurl parameters.
🧯 If You Can't Patch
- Decommission and replace affected UTT 750W devices with supported alternatives
- Implement strict network access controls allowing only trusted IPs to access device management interfaces
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or CLI. If version is 3.2.2-191225 or earlier, device is vulnerable.Check Version:
Check via web interface at http://device-ip/ or consult device documentation for CLI version check.Verify Fix Applied:
Verify firmware version has been updated beyond 3.2.2-191225 (though no official patch exists).📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/formPictureUrl with unusually long importpictureurl parameters
- Device crash/restart logs following web interface access
Network Indicators:
- HTTP POST requests to /goform/formPictureUrl with crafted importpictureurl values
- Unusual outbound connections from UTT 750W devices
SIEM Query:
source="*UTT*" AND (url="/goform/formPictureUrl" OR url="*formPictureUrl*") AND (param="*importpictureurl*" OR data="*importpictureurl*")