A security flaw was identified in the UTT HiPER 810G firmware, affecting the /goform/formRemoteControl endpoint up to version 1.7.7‑171114. The bug stems from an unsafe use of the C library function strcpy, which can overflow a buffer when a payload longer than the allocated space is received. The endpoint is reachable over the network, so the attack vector is remote. The description does not explicitly state that arbitrary code execution is achieved; however, as a buffer overflow it potentially allows the attacker to alter the device’s execution flow.

The vulnerability exists on UTT HiPER 810G devices running firmware 1.7.7‑171114 or earlier, specifically on builds that include the legacy strcpy implementation within the /goform/formRemoteControl module.

The CVSS base score of 8.7 signals high severity, while an EPSS figure below 1 % indicates a low but non‑zero probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, but publicly available exploit code raises concern. Exploitation requires sending a crafted HTTP request to the vulnerable endpoint without authentication. While the description does not confirm the exact impact, the overflow could plausibly lead to arbitrary code execution, which would compromise confidentiality, integrity, and availability of the device.