CVE-2025-15429

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCliForEngineerOnly. Such manipulation of the argument addCommand leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 512W	1.7.7-171114

References

https://github.com/Lena-lyy/cve/blob/main/1223/19.mdExploit, Third Party Advisory
https://github.com/Lena-lyy/cve/blob/main/1223/19.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.339351Permissions Required, VDB Entry
https://vuldb.com/?id.339351Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721876Third Party Advisory, VDB Entry

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-15434.3A vulnerability, which was classified as problematic, has been found in iteachyou Dreamer CMS 4.1.3. This issue affects some unknown process CVE-2025-154308.8A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerSha CVE-2025-154318.8A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a CVE-2025-154327.5A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function d CVE-2025-154336.8The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such CVE-2025-154349.8A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argu CVE-2025-154359.8A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp.CVE-2025-154369.8A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp CVE-2025-154375.4A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performin CVE-2025-154387.2A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php CVE-2025-154396.3A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_CVE-2025-15446.3A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /a