CVE-2025-13442 is a high severity command injection in the UTT 750W router, firmware up to 3.2.2-191225, scored 7.3 by CVSS 3.1. The weakness is in /goform/formPdbUpConfig and involves the policyNames argument. The vendor did not respond to the disclosure, so no fix is known.
What's affected
The record lists the UTT 750W and its firmware up to 3.2.2-191225. The vulnerable function is system inside the handler /goform/formPdbUpConfig, and the input at fault is policyNames.
According to the CVSS vector the attack is remote, low complexity and needs no privileges and no user interaction. The record states that an exploit has been disclosed publicly. It also says the vendor was contacted early and did not respond in any way. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
No fixed firmware is named anywhere in the record.
How to check if you're exposed
Open the device's web interface and read the firmware version on the system page. Anything up to 3.2.2-191225 on this model falls inside the affected range. Next, find out whether the management interface answers from the internet. A scan of your public address from outside your network will show open admin ports.
For fleets of devices, keep a list of model and firmware per site. If you collect firmware images or SBOMs, a scan can match them against records like this one. The free scan at gold.safeguard.sh/scan handles software dependencies, and the Gold directory lists this entry.
What to do now
- List every UTT 750W you run and its firmware version.
- Disable remote management on the WAN side today.
- Allow access to the admin page only from a small set of trusted internal addresses.
- Change administrator credentials and make them unique.
- Segment the device so that a compromise cannot reach important systems.
- Check the vendor site for newer firmware, and read the notes before applying it.
- Plan a replacement if the vendor stays silent, since an unpatched, publicly exploitable gateway is a standing risk.
Why it matters
The cause is CWE-77 (command injection), within the wider CWE-74 (injection) class. The handler passes a value from the web request into a call that runs operating system commands. If the value is not checked, the device may run commands the author never intended.
Because the vector needs no authentication, the only protection is keeping the management page unreachable. A router runs with high privileges and carries all of your traffic, so command execution on it is serious even when the CVSS score is 7.3.
The silence of the vendor matters as much as the bug. Without a patch, network controls are your only fix.
Quick check
Is there a fix for CVE-2025-13442?
None is named in the record, which says the vendor did not respond to the disclosure. Check the vendor site before you assume otherwise.
What is the fastest protection?
Make sure the web administration interface is not reachable from the internet, and limit it to trusted internal addresses.
Sources
Last reviewed: 19 October 2026.
