The UTT Jinqi 750W router is vulnerable to a remotely exploitable buffer overflow that can lead to a complete denial of service.

This memory corruption flaw exists within the /goform/formPictureUrl endpoint. An authenticated attacker can send a crafted request containing an oversized payload in the importpictureurl parameter to trigger a buffer overflow, resulting in a system crash.

Successful exploitation of this vulnerability results in a denial of service, rendering the network appliance unresponsive and disrupting all traffic routed through the device. Given the CVSS score of 8.8, this represents a high-severity risk to business continuity, as routers are critical infrastructure for network connectivity and security enforcement.

Immediate Action: Since the vendor has not provided a patch, restrict access to the web management interface to trusted administrative IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/formPictureUrl endpoint. Watch for unexpected system restarts or periods of device unavailability that may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with custom signatures to inspect and block excessively long strings sent to the importpictureurl parameter.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's published write-up on GitHub.

Due to the lack of a vendor-supplied patch and the availability of a functional proof-of-concept, this vulnerability poses a significant risk to network stability. Administrators should immediately isolate the management interface of affected UTT routers from untrusted networks and implement strict access control lists to prevent unauthorized access until a firmware update is released.