High severity · published Sep 9, 2025
CVE-2025-10172
UTT 750W formPictureUrl buffer overflow
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. Executing manipulation of the argument importpictureurl can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
75
750W · UTT
3.2.2-191225 · source: vendor
7F
750w Firmware · Utt
through 3.2.2-191225 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10172
Exploit
https://github.com/cymiao1978/cve/blob/main/1.md
Permissions Required
https://vuldb.com/?ctiid.323207
Third Party Advisory
https://vuldb.com/?id.323207
Third Party Advisory
https://vuldb.com/?submit.639030
More from 750W
9.8
CVE-2025-13442
UTT 进取 750W formPdbUpConfig system command injection
9.8
CVE-2025-6098
UTT 进取 750W API setSysAdm strcpy buffer overflow
9.8
CVE-2025-6097
UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change
7.5
CVE-2025-7116
UTT 进取 750W Fast_wireless_conf buffer overflow