CVE-2025-6097
📋 TL;DR
This vulnerability allows remote attackers to change the administrator password without verification on UTT 进取 750W devices up to version 5.0. Attackers can exploit the formDefineManagement function in the Administrator Password Handler component by manipulating the passwd1 parameter. This affects all users of these devices with vulnerable firmware.
💻 Affected Systems
- UTT 进取 750W
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover by unauthorized actors who can change admin credentials, potentially leading to persistent access, configuration changes, or use as an attack vector in the network.
Likely Case
Unauthorized password reset allowing attackers to gain administrative access to the device, potentially enabling further network attacks or device manipulation.
If Mitigated
Limited impact if devices are behind firewalls with restricted access and proper network segmentation is implemented.
🎯 Exploit Status
Exploit code is publicly available on GitHub. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. The vendor did not respond to disclosure. Consider replacing devices or implementing workarounds.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the device management interface using firewall rules
Management Interface Isolation
allPlace the device management interface on a separate VLAN with strict access controls
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected devices from untrusted networks
- Monitor for unauthorized password change attempts and implement alerting for admin credential modifications
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If version is 5.0 or earlier, device is vulnerable.Check Version:
Check via web interface at device IP or use device-specific CLI commands if availableVerify Fix Applied:
No official fix available to verify. Monitor for vendor updates and test password change functionality with verification.📡 Detection & Monitoring
Log Indicators:
- Unusual password change events in admin logs
- Multiple failed login attempts followed by password reset
- Access from unexpected IP addresses to /goform/setSysAdm
Network Indicators:
- HTTP POST requests to /goform/setSysAdm with passwd1 parameter from unauthorized sources
- Unusual traffic patterns to device management interface
SIEM Query:
source_ip NOT IN (allowed_admin_ips) AND uri_path="/goform/setSysAdm" AND http_method="POST"