CVE-2025-15430

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Performing a manipulation of the argument oldfilename results in buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 512W	1.7.7-171114

References

https://github.com/GUOTINGTING2297/cve/blob/main/1234/20.mdExploit, Third Party Advisory
https://github.com/GUOTINGTING2297/cve/blob/main/1234/20.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.339352Permissions Required, VDB Entry
https://vuldb.com/?id.339352Third Party Advisory, VDB Entry
https://vuldb.com/?submit.721888Third Party Advisory, VDB Entry

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-154318.8A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a CVE-2025-154327.5A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function d CVE-2025-154336.8The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server (such CVE-2025-154349.8A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. The manipulation of the argu CVE-2025-154359.8A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp.CVE-2025-154369.8A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp CVE-2025-154375.4A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performin CVE-2025-154387.2A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php CVE-2025-154396.3A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_CVE-2025-15446.3A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /a CVE-2025-154407.2The iONE360 configurator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Form Parameters in all versions CVE-2025-154416.8The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, w