CVE-2025-7117
📋 TL;DR
A critical buffer overflow vulnerability in UTT HiPER 840G routers allows remote attackers to execute arbitrary code by manipulating the addHostFilter parameter. This affects all systems running HiPER 840G firmware up to version 3.1.1-190328. Attackers can exploit this without authentication to potentially take full control of affected routers.
💻 Affected Systems
- UTT HiPER 840G
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete router compromise, network traffic interception, lateral movement into internal networks, and persistent backdoor installation.
Likely Case
Router compromise allowing attackers to modify network configurations, intercept traffic, or use the device as a pivot point for further attacks.
If Mitigated
Limited impact if the router is behind strict firewall rules, but still vulnerable to internal threats.
🎯 Exploit Status
Proof of concept exploit code is publicly available on GitHub. The vulnerability requires no authentication and has a straightforward exploitation path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
No official patch available. Consider upgrading to any newer firmware version if released by UTT, or replace the device with a different model/vendor.
🔧 Temporary Workarounds
Block Web Management Interface
allRestrict access to the router's web management interface to trusted IP addresses only
Configure firewall rules to block external access to port 80/443 on the router
Use ACLs to restrict management interface access to specific IP ranges
Disable Unnecessary Services
allDisable remote management features if not required
Disable WAN-side management access in router settings
Turn off UPnP and other unnecessary services
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict network segmentation
- Implement network monitoring and intrusion detection specifically for traffic to/from affected routers
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at System > System Info or via SSH using 'show version' commandCheck Version:
ssh admin@router-ip 'show version' or check web interface at System > System InfoVerify Fix Applied:
Verify firmware version is newer than 3.1.1-190328. Since no patch exists, replacement is the only verification method.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /goform/websWhiteList with long addHostFilter parameters
- Multiple failed buffer overflow attempts in system logs
- Unexpected process crashes or restarts
Network Indicators:
- Unusual traffic patterns to router management interface from external IPs
- POST requests with abnormally long parameter values
SIEM Query:
source="router_logs" AND (uri_path="/goform/websWhiteList" AND (param_length>1000 OR contains(param_value, "overflow")))