Description
A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack‑based buffer overflow exists in the strcpy call within the APSecurity_5g module of UTT HiPER 1250GW. By manipulating the cipher argument, an attacker can overwrite the stack and execute arbitrary code. This flaw corresponds to CWE‑119 and CWE‑121 and allows remote exploitation without local interaction.

Affected Systems

The affected product is UTT HiPER 1250GW versions up to 3.2.7‑210907‑180535. All devices running these revisions are vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity. EPSS data is not available, so an exact exploitation probability cannot be determined, but the vulnerability is publicly known and a public exploit exists. The vulnerability is not listed in CISA KEV, but the lack of a vendor response increases risk. The attack vector is remote, requiring only the ability to send a crafted cipher value to the /goform/APSecurity_5g endpoint.

Generated by OpenCVE AI on August 5, 2026 at 03:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the vendor patch that corrects the strcpy stack overflow in the APSecurity_5g module.
  • Restrict or block remote access to the /goform/APSecurity_5g endpoint using firewall or access control rules.
  • Enable logging and alerting for anomalous cipher request patterns and investigate repeated failures.

Generated by OpenCVE AI on August 5, 2026 at 03:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow
First Time appeared Utt
Utt hiper 1250gw
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:utt:hiper_1250gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1250gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1250gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T01:30:09.820Z

Reserved: 2026-08-04T19:54:52.436Z

Link: CVE-2026-18895

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T03:30:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow