CVE-2026-1138

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw has been found in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/ConfigExceptQQ. Executing a manipulation can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
UTT	进取 520W	1.7.7-180627

References

https://github.com/cymiao1978/cve/blob/main/new/33.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.341729Permissions Required, VDB Entry
https://vuldb.com/?id.341729Third Party Advisory, VDB Entry
https://vuldb.com/?submit.735298Third Party Advisory, VDB Entry

Timeline

Published: Jan 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-113806.4The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.21. This CVE-2026-1138005.4Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 4 CVE-2026-1138029.8Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos b CVE-2026-1138087.1A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS CVE-2026-113818.8IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation o CVE-2026-1138107.0A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS CVE-2026-1138117.5Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search CVE-2026-1138129.1Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bu CVE-2026-1138136.5The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthen CVE-2026-1138148.8Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.CVE-2026-1138154.7Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature l CVE-2026-1138164.1Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.