CVE-2025-13442
📋 TL;DR
This CVE describes a command injection vulnerability in UTT 进取 750W devices up to version 3.2.2-191225. Attackers can remotely execute arbitrary commands by manipulating the policyNames parameter in the /goform/formPdbUpConfig endpoint. Organizations using these affected network devices are at risk.
💻 Affected Systems
- UTT 进取 750W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands with device privileges, potentially leading to network infiltration, data theft, or device takeover.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or disrupt network operations.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable endpoints.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily weaponizable. No authentication required for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider workarounds or replacement.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to the vulnerable endpoint using firewall rules
iptables -A INPUT -p tcp --dport 80 -m string --string "/goform/formPdbUpConfig" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/goform/formPdbUpConfig" --algo bm -j DROP
Web Application Firewall
allDeploy WAF rules to block command injection patterns in policyNames parameter
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict access controls
- Implement network monitoring and intrusion detection for suspicious traffic to /goform/formPdbUpConfig
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If version is 3.2.2-191225 or earlier, device is vulnerable.Check Version:
Check via web interface at http://device-ip/ or via SSH/Telnet if availableVerify Fix Applied:
No official fix available to verify. Workarounds can be tested by attempting to access /goform/formPdbUpConfig with blocked patterns.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formPdbUpConfig
- Commands with shell metacharacters in policyNames parameter
- Unexpected process execution from web service
Network Indicators:
- HTTP POST requests to /goform/formPdbUpConfig containing shell commands
- Outbound connections from device to unexpected destinations
SIEM Query:
source="web_logs" AND uri="/goform/formPdbUpConfig" AND (policyNames CONTAINS "|" OR policyNames CONTAINS ";" OR policyNames CONTAINS "`" OR policyNames CONTAINS "$")