CVE-2025-6097 is a medium (CVSS 5.3) unverified password change in UTT 750W devices up to version 5.0. The record says the formDefineManagement function behind /goform/setSysAdm accepts a new administrator password without proper checks. The vendor did not respond to the disclosure, and no fix is named.
What's affected
- Product: UTT 750W (also written 进取 750W), a network device, with its firmware.
- Affected: up to version 5.0.
- Vulnerable code: the
formDefineManagementfunction of/goform/setSysAdm, in the administrator password handler, argumentpasswd1. - Weaknesses: CWE-620 (unverified password change) and CWE-640 (weak password recovery for forgotten password).
- Fixed: none named in the record. It says the vendor was contacted early and did not respond.
- CVSS 3.1: 5.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. No login is needed according to the vector. - Public exploit: the record says the exploit has been disclosed to the public and may be used.
- Known exploited: no, the record is not on the CISA KEV list.
How to check if you're exposed
Find the devices first. Check your network inventory for UTT 750W units, and look at the device status or about page in the admin interface for the firmware version. Version 5.0 or lower is in scope.
Then check how the management interface is reachable:
# from a host OUTSIDE your trusted network, test whether the admin port answers
nc -zv <device-address> 80 443 8080
Replace the placeholder with your device's address. If the management port answers from the internet or a guest network, treat that as a finding. Also check whether the administrator password has changed without your team doing it, by trying your known credentials from a trusted host.
What to do now
- Inventory every UTT 750W device and record its firmware version.
- Remove management access from the internet and from untrusted networks. Allow it only from a dedicated admin network or VPN.
- Check the UTT support pages for newer firmware. The record names none, so confirm directly with the vendor.
- Verify the administrator credentials still work, and set a new strong password from a trusted host if in doubt.
- Back up the device configuration and review it for unexpected changes such as new users or forwarding rules.
- If the vendor offers no fix, plan to replace the device, since an unpatched edge router is a standing risk.
Why it matters
An unverified password change (CWE-620) means the device lets someone set a new administrator password without proving they are allowed to. The record also lists CWE-640, which relates to weak recovery of forgotten passwords.
On a router or similar device, the administrator account controls routing, firewall rules and traffic. Changing it is the first step to taking over the device. The vector rates the integrity impact as low and the other impacts as none, which explains the medium score, but real impact depends on what the device protects.
Vendors of small network equipment often do not publish fixes, and the record says this one did not respond. In that situation your controls are network placement and, eventually, replacement. The record does not claim exploitation in the wild.
Quick check
Is there firmware that fixes this?
The CVE record names no fixed version and says the vendor did not respond. Ask the vendor directly and limit management access meanwhile.
Why is the severity only medium?
The vector shows low integrity impact and no confidentiality or availability impact. The practical risk depends on how exposed the device is.
Sources
- Safeguard Gold entry for CVE-2025-6097
- github.com/pfwqdxwdd/cve/blob/main/6.md (listed in the CVE record, not fetched)
- github.com/pfwqdxwdd/cve/blob/main/6.md#poc (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
