Description
A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow (CWE-119 and CWE-121) was discovered in the strcpy implementation of the /goform/ConfigAdvideo function in UTT HiPER 1200GW. By supplying a crafted timestart argument the attacker can overflow the stack, potentially gaining arbitrary code execution on the device. This vulnerability directly impacts confidentiality, integrity, and availability, as adversaries could run malicious code or disrupt service.

Affected Systems

The flaw affects UTT HiPER 1200GW firmware versions up to and including v2.5.3-170306. No other versions were enumerated as affected in the provided data.

Risk and Exploitability

The CVSS score of 8.7 classifies the vulnerability as high severity, and the exploit is remotely accessible. EPSS data is not available, and the issue is not yet listed in the CISA KEV catalog, but the public release of an exploit indicates a realistic threat. The likely attack vector is via an unauthenticated HTTP request to the vulnerable endpoint, making the flaw exploitable by any network actor that can reach the device.

Generated by OpenCVE AI on August 5, 2026 at 04:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Restrict or block access to the /goform/ConfigAdvideo endpoint from untrusted networks, limiting exposure to the vulnerable firmware.
  • Continuously monitor incoming traffic and device logs for anomalous activity or signature patterns associated with the buffer overflow exploit.
  • Proactively request an official patch from UTT; if no patch is issued, consider disabling the ConfigAdvideo functionality or removing the vulnerable code from the firmware to mitigate the risk.

Generated by OpenCVE AI on August 5, 2026 at 04:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow
First Time appeared Utt
Utt hiper 1200gw
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:utt:hiper_1200gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1200gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1200gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T03:00:09.275Z

Reserved: 2026-08-04T19:59:21.742Z

Link: CVE-2026-18898

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T05:00:11Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow