A buffer overflow exists in the strcpy function of the /goform/setSysAdm page of UTT HiPER 810 firmware 1.7.4‑141218. The vulnerability allows an attacker to manipulate the passwd1 argument, causing a buffer overrun that can result in arbitrary code execution. Remote exploitation is feasible and exploitation code has already been published. The assigned CVSS score of 9.3 indicates a critical level of risk for confidentiality, integrity, and availability.

The flaw affects UTT’s HiPER 810 series, specifically firmware version 1.7.4‑141218. Any device running this firmware and exposing the /goform/setSysAdm interface is susceptible; other firmware releases and hardware models are not known to be impacted.

The CVSS base score of 9.3 signals a severe risk, while the EPSS score of <1% suggests the likelihood of exploitation is currently low. Nevertheless, an exploit has been publicly demonstrated and the vulnerability is not yet listed in the KEV catalog, meaning no public mitigation guidance from that source exists. The attack vector is remote over the network, typically via HTTP requests to the affected endpoint, and does not require local access. Once the overflow is triggered, an attacker gains unrestricted control over the device’s operating system.