CVE-2025-6734
📋 TL;DR
A critical buffer overflow vulnerability in UTT HiPER 840G routers allows remote attackers to execute arbitrary code by sending specially crafted requests to the API's formP2PLimitConfig endpoint. This affects all versions up to 3.1.1-190328. Attackers can potentially take full control of affected devices.
💻 Affected Systems
- UTT HiPER 840G
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, lateral movement to internal networks, and use as botnet node.
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept traffic, or disrupt network services.
If Mitigated
Limited impact if device is behind firewall with strict API access controls, though buffer overflow could still cause service disruption.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. The vulnerability requires no authentication and is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider replacing affected devices or implementing strict network controls.
🔧 Temporary Workarounds
Network Access Control
linuxBlock external access to the router's management interface and API endpoints
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 8080 -j DROP
API Endpoint Disable
allDisable the vulnerable API endpoint if possible through configuration
🧯 If You Can't Patch
- Isolate affected routers in separate network segments with strict firewall rules
- Implement network monitoring for unusual API requests to /goform/formP2PLimitConfig
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or CLI. If version is 3.1.1-190328 or earlier, device is vulnerable.Check Version:
Check web interface at http://[router-ip]/ or use telnet/ssh to access CLI and check versionVerify Fix Applied:
No official fix available to verify. Monitor for vendor updates and check version after any potential update.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/formP2PLimitConfig
- Large payloads in API requests
- Device reboot or configuration changes without authorization
Network Indicators:
- Unusual outbound connections from router
- Traffic spikes from router to unknown destinations
- API requests with abnormal 'except' parameter values
SIEM Query:
source="router" AND (url="/goform/formP2PLimitConfig" OR method="POST" AND uri CONTAINS "formP2PLimitConfig")