CVE-2025-11652
📋 TL;DR
A buffer overflow vulnerability in UTT 进取 518G routers allows remote attackers to execute arbitrary code by manipulating the txtMin2 parameter in the /goform/formTaskEdit_ap endpoint. This affects all versions up to V3v3.2.7-210919-161313. Organizations using these routers are at risk of complete system compromise.
💻 Affected Systems
- UTT 进取 518G router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full router compromise, network infiltration, data exfiltration, and persistent backdoor installation.
Likely Case
Router takeover enabling man-in-the-middle attacks, credential theft, and network disruption.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Public proof-of-concept exploit is available on GitHub. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider replacing affected routers with supported alternatives.
🔧 Temporary Workarounds
Block vulnerable endpoint
linuxUse firewall rules to block access to /goform/formTaskEdit_ap endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/formTaskEdit_ap" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/goform/formTaskEdit_ap" --algo bm -j DROP
Network segmentation
allIsolate affected routers in separate VLANs with strict access controls
🧯 If You Can't Patch
- Replace affected routers with supported models from different vendors
- Implement strict network segmentation and monitor all traffic to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check router web interface or CLI for firmware version. If version is V3v3.2.7-210919-161313 or earlier, device is vulnerable.Check Version:
Check router web interface at System Status > Firmware Version or use SNMP queryVerify Fix Applied:
No official fix available. Workaround verification involves testing that /goform/formTaskEdit_ap endpoint is inaccessible.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /goform/formTaskEdit_ap with long txtMin2 parameter values
- Unusual process creation or memory errors in router logs
Network Indicators:
- HTTP POST requests to router IP with /goform/formTaskEdit_ap path
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND (uri="/goform/formTaskEdit_ap" OR (http_method="POST" AND uri CONTAINS "formTaskEdit_ap"))🔗 References
- https://github.com/cymiao1978/cve/blob/main/14.md
- https://github.com/cymiao1978/cve/blob/main/14.md#poc
- https://vuldb.com/?ctiid.328069
- https://vuldb.com/?id.328069
- https://vuldb.com/?submit.664926
- https://github.com/cymiao1978/cve/blob/main/14.md
- https://github.com/cymiao1978/cve/blob/main/14.md#poc
