CVE-2025-11651 Overview
CVE-2025-11651 is a buffer overflow vulnerability in the UTT 进取 518G router firmware up to version V3v3.2.7-210919-161313. The flaw resides in the sub_4247AC function within the /goform/formRemoteControl endpoint. Attackers manipulate the Profile argument to trigger memory corruption [CWE-119]. The vulnerability is exploitable remotely over the network and requires low privileges. The exploit details have been disclosed publicly. The vendor was notified prior to disclosure but did not respond.
Critical Impact
Remote attackers with low privileges can corrupt memory through the Profile parameter, potentially leading to arbitrary code execution or device compromise on affected UTT 518G routers.
Affected Products
- UTT 518G firmware up to V3v3.2.7-210919-161313
- UTT 518G hardware version 3.0
- UTT 进取 518G series routers
Discovery Timeline
- 2025-10-13 - CVE-2025-11651 published to NVD
- 2026-01-08 - Last updated in NVD database
Technical Details for CVE-2025-11651
Vulnerability Analysis
The vulnerability is a classic buffer overflow [CWE-119] in the UTT 518G web management interface. The sub_4247AC function processes requests submitted to the /goform/formRemoteControl handler without enforcing length boundaries on the Profile parameter. Supplying an oversized value writes beyond the destination buffer in memory.
Buffer overflows in MIPS-based embedded routers commonly enable adjacent stack data corruption, including saved return addresses. An attacker with valid low-privilege credentials can reach this endpoint remotely over HTTP. The EPSS score is 0.337% with a percentile of 56.762.
Root Cause
The root cause is the absence of bounds checking when the sub_4247AC function copies the user-controlled Profile argument into a fixed-size buffer. The firmware accepts arbitrary-length input from the formRemoteControl form handler and writes it directly to stack or heap memory.
Attack Vector
The attack vector is network-based. An authenticated attacker submits a crafted HTTP POST request to /goform/formRemoteControl with an oversized Profile field. The malformed request reaches sub_4247AC, which overflows the target buffer. Successful exploitation can crash the device or hijack control flow to execute attacker-supplied instructions.
A public proof-of-concept reference is available at the GitHub PoC Reference and VulDB #328068.
Detection Methods for CVE-2025-11651
Indicators of Compromise
- HTTP POST requests to /goform/formRemoteControl containing abnormally large Profile parameter values
- Unexpected reboots or crashes of UTT 518G routers following web administration traffic
- Web management sessions originating from untrusted networks or unusual source IPs
- Outbound connections from the router to unrecognized command-and-control hosts after exploitation
Detection Strategies
- Inspect HTTP request bodies destined for the router management interface for Profile field length anomalies
- Deploy network IDS rules that flag overlong form parameters posted to /goform/ URIs on UTT devices
- Correlate router crash events with preceding administrative HTTP traffic in centralized logs
Monitoring Recommendations
- Forward router syslog and HTTP access logs to a centralized SIEM for parameter-length analysis
- Alert on any external access attempts to the device management interface
- Monitor for new processes or configuration changes on the router following web requests
How to Mitigate CVE-2025-11651
Immediate Actions Required
- Restrict access to the /goform/formRemoteControl endpoint to trusted management networks only
- Disable remote WAN-side administration on UTT 518G devices
- Rotate administrative credentials and enforce strong passwords to limit low-privilege access
- Place affected routers behind a network segmentation boundary until a vendor patch is available
Patch Information
No vendor patch is currently available. According to the disclosure, the vendor was contacted but did not respond. Organizations should monitor VulDB #328068 and the GitHub CVE Details entry for updates. Consider replacing affected devices with supported alternatives if vendor remediation is not forthcoming.
Workarounds
- Block inbound HTTP and HTTPS traffic to the router management interface from untrusted networks at the perimeter firewall
- Limit administrative access to specific source IP addresses using ACLs where supported
- Disable remote management features that expose formRemoteControl to non-LAN interfaces
- Place the device behind a hardened upstream gateway that filters malformed HTTP form payloads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
