CVE-2025-10953 in 1200GW
Summary
by MITRE • 09/25/2025
A security vulnerability has been detected in UTT 1200GW and 1250GW up to 3.0.0-170831/3.2.2-200710. This vulnerability affects unknown code of the file /goform/formApMail. The manipulation of the argument senderEmail leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2025
This vulnerability resides in the UTT 1200GW and 1250GW network devices running firmware versions up to 3.0.0-170831 and 3.2.2-200710 respectively. The affected component is the /goform/formApMail file which handles email configuration functionality within the device's web interface. The vulnerability manifests as a buffer overflow condition when processing the senderEmail argument, representing a critical security flaw that allows attackers to manipulate input parameters beyond the allocated memory boundaries. This specific implementation flaw falls under the CWE-121 buffer overflow category, where insufficient bounds checking permits arbitrary data to overwrite adjacent memory locations, potentially leading to unauthorized code execution or system compromise.
The attack vector is remotely exploitable, meaning malicious actors can trigger this vulnerability without requiring physical access to the device or network proximity. The public disclosure of the exploit increases the risk profile significantly as it provides threat actors with readily available attack methods. This remote code execution capability allows attackers to potentially gain full control over the affected devices, enabling them to modify network configurations, intercept traffic, or use the compromised devices as entry points for broader network infiltration. The vulnerability's impact extends beyond individual device compromise to potentially affect entire network infrastructures that rely on these access points.
The lack of vendor response after early notification represents a critical failure in the vulnerability disclosure process and leaves affected organizations without official patches or mitigation guidance. This scenario aligns with ATT&CK technique T1190 - Exploit Public-Facing Application, where adversaries target vulnerabilities in externally accessible systems. Organizations should immediately implement network segmentation to isolate these devices from critical infrastructure, disable unnecessary services, and monitor network traffic for signs of exploitation attempts. The vulnerability's presence in the web form handling component suggests potential impacts on email notification systems, which could be leveraged for phishing attacks or to establish command and control channels.
Recommended mitigations include implementing network access controls to restrict access to the affected web interface, deploying intrusion detection systems to monitor for exploitation attempts, and establishing a patch management process to update firmware versions as soon as vendor patches become available. Organizations should also conduct comprehensive network assessments to identify all affected devices and implement temporary workarounds such as disabling email functionality or restricting the senderEmail parameter processing. The vulnerability demonstrates the importance of secure input validation and proper memory management practices in embedded systems, particularly those handling user-supplied data through web interfaces. This flaw represents a significant risk to network security and requires immediate attention from network administrators and cybersecurity teams responsible for protecting enterprise infrastructure.