CVE-2025-14191 is a high severity (CVSS 8.8) buffer overflow in the UTT 512W router, versions up to 1.7.7-171114. A strcpy call in the web form handler /goform/formP2PLimitConfig can be reached over the network. The record names no fixed firmware and says the vendor did not respond, so restrict management access and plan for replacement.
What's affected
- Product: UTT 512W (UTT 进取 512W) and its firmware.
- Affected versions: up to and including 1.7.7-171114.
- Component: the function using
strcpyin the file/goform/formP2PLimitConfig, through the argument namedexcept. - Fixed version: none is named in the record. The description says the vendor was contacted early and did not respond.
- Weakness: CWE-119 (improper restriction of operations within a memory buffer) and CWE-120 (classic buffer overflow). The entry is on the Gold page for CVE-2025-14191.
- Severity: High, CVSS 8.8, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. - CISA KEV: not listed.
How to check if you're exposed
The firmware version is shown in the router's web administration page, usually under a system status or about screen. Compare it with 1.7.7-171114. If yours is that version or older, treat it as affected.
Also check where the management interface listens. The vector says the attack runs over the network and needs a low privilege account, so the question is who can reach the admin pages. From a machine outside your network, test whether the router's web administration answers on its public address. If it does, that is the exposure to fix first.
Keep a list of every UTT unit you run, including branch offices, with firmware versions next to each one. Embedded devices rarely appear in a package manifest, so the inventory has to be built by hand or from your network records.
What to do now
- List all UTT 512W units and read their firmware versions.
- Turn off remote (WAN side) administration. Limit the admin pages to a management network or a VPN.
- Change administrator passwords to long unique ones, since the vector requires a logged in account.
- Ask UTT for a fixed firmware through your supplier and keep the reply. The record shows no response to the researcher, so do not wait on it.
- Plan replacement for units that must face untrusted networks. A device with a known, unpatched memory flaw and a public write up is a poor edge device.
- Watch the NVD record for any later fix.
Why it matters
A strcpy call copies data until it finds a terminating byte, with no check on the size of the destination. When the data comes from a request parameter, a long enough value writes past the end of the buffer. On a router, memory corruption of this kind can crash the web service and, depending on the device, may allow more than that. The record rates the impact on confidentiality, integrity and availability as high.
The practical problem is the vendor silence. With no patch, the only controls are network controls: keep the admin interface off the internet, limit who can reach it, and retire the device when you can. The record does not mark this CVE as exploited, and it is not in CISA KEV, but the description says an exploit has been published.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a firmware fix for CVE-2025-14191?
The record names none and says the vendor did not respond. Ask UTT directly and check the advisory sources before assuming a patch exists.
Does this need a login?
The vector shows low privileges required, so an account on the device is needed. Weak or shared admin passwords make that bar lower.
Sources
- NVD record data for CVE-2025-14191 (Safeguard Gold entry)
- Public report
- Public report
Last reviewed: 19 October 2026.
