A buffer overflow exists in the file /goform/setSysAdm within UTT HiPER 1250GW. The overflow is triggered by the argument GroupName passed to the strcpy function. This flaw allows an attacker to send crafted data that exceeds the allocated buffer, potentially overwriting control data on the stack and enabling arbitrary code execution. The issue is classified as a serious memory safety violation (CWE-119) and a stack-based buffer overflow (CWE-120).

The vulnerability affects UTT's HiPER 1250GW product. Versions up to 3.2.7‑210907‑180535 are impacted. No other vendor or product versions are listed as affected.

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS score is publicly available, and the flaw is not currently listed in the CISA KEV catalog, but publicly available exploits have been identified. The description notes that the attack can be launched remotely; it is inferred that remote access to the /goform/setSysAdm HTTP endpoint is required to exploit the flaw. Given the high CVSS and the availability of exploits, the risk to systems exposing this endpoint is substantial, especially if they are reachable from untrusted networks.