CVE-2025-15428

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the argument Profile causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 512W	1.7.7-171114

References

https://github.com/Lena-lyy/cve/blob/main/1223/18.mdExploit, Third Party Advisory
https://github.com/Lena-lyy/cve/blob/main/1223/18.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.339350Permissions Required, VDB Entry
https://vuldb.com/?id.339350Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721875Third Party Advisory, VDB Entry

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-154298.8A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /g CVE-2025-15434.3A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown process CVE-2025-154308.8A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerSha CVE-2025-154318.8A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a CVE-2025-154327.5A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function d CVE-2025-154336.8The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such CVE-2025-154349.8A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argu CVE-2025-154359.8A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp.CVE-2025-154369.8A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp CVE-2025-154375.4A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performin CVE-2025-154387.2A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php CVE-2025-154396.3A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_