The vulnerability exists in the strcpy function used by the /goform/formConfigDnsFilterGlobal endpoint of UTT HiPER 2610G. Manipulating the GroupName argument causes a buffer overflow, which can overwrite memory and give an attacker control over program execution. The violation is a classic stack-based buffer overflow that could be leveraged to execute arbitrary code in the device's firmware, compromising confidentiality, integrity and availability of the gateway.

The flaw impacts UTT HiPER 2610G devices running firmware versions up to and including 3.0.0-171107. Only this product family is listed as affected and no newer versions are confirmed to be large enough to mitigate the issue within the provided data.

The CVSS score is 8.7, indicating high severity. An EPSS score is not available, so the current likelihood of exploitation is unknown; however, the vulnerability can be triggered remotely via standard HTTP form requests, and public exploits have already been disclosed. The issue is not listed in CISA KEV, but its nature suggests that attackers could target vulnerable routers in the network without requiring local access.