UTT 750W Buffer Overflow Vulnerability in FormPictureUrl Processing

A buffer overflow vulnerability has been identified in the UTT 750W router, specifically in firmware versions through 3.2.2-191225. The issue arises in the file '/goform/formPictureUrl', where the 'importpictureurl' parameter can be manipulated, leading to a buffer overflow. This vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability causes a buffer overflow, which can lead to a denial-of-service condition on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to '/goform/formPictureUrl' with a carefully crafted 'importpictureurl' parameter. The request must include appropriate headers for authorization and content type. The payload should be designed to overflow the buffer, which can be achieved by exceeding the expected length of the 'importpictureurl' parameter.