CVE-2025-7116

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in UTT 进取 750W up to 3.2.2-191225. This affects an unknown part of the file /goform/Fast_wireless_conf. The manipulation of the argument ssid leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 750W	3.2.2-191225

References

https://github.com/d2pq/cve/blob/main/616/10.mdExploit, Third Party Advisory
https://github.com/d2pq/cve/blob/main/616/10.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.315027Permissions Required, VDB Entry
https://vuldb.com/?id.315027Third Party Advisory, VDB Entry
https://vuldb.com/?submit.605862Third Party Advisory, VDB Entry

Timeline

Published: Jul 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-711605.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahf CVE-2025-711615.5In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two pr CVE-2025-711627.8In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists CVE-2025-711635.5In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix device leaks on compat bind and unbind Make sure CVE-2025-711645.4Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The i CVE-2025-711655.4Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface CVE-2025-711665.4Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface CVE-2025-71178.8A vulnerability classified as critical was found in UTT HiPER 840G up to 3.1.1-190328. This vulnerability affects unknown code of the file /CVE-2025-711766.8pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial o CVE-2025-711775.4LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search func CVE-2025-711787.1Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the insta CVE-2025-711796.1Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs en