CVE-2025-10172 HIGH

CVE-2025-10172: UTT 750W formPictureUrl buffer overflow

Vendor Utt

Product 750W

Weakness CWE-120

Published September 9, 2025

Last update September 10, 2025

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A flaw has been found in UTT 750W up to 3.2.2-191225. This issue affects some unknown processing of the file /goform/formPictureUrl. Executing manipulation of the argument importpictureurl can lead to buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

September 9, 2025 CVE published

September 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-10172 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/120.html

Related vulnerabilities

04Related CVE

CVE-2022-39344 Azure RTOS USBX vulnerable to buffer overflow CVE-2025-24003 MQTT OOB Write Vulnerability in EichrechtAgents of German EV Charging Stations CVE-2018-25288 StyleWriter 1.0 Denial of Service via Pattern Input CVE-2025-1253 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags. CVE-2024-33042 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host