Description
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBind results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Published: 2026-04-05
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via buffer overflow
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow occurs in the strcpy function within the /goform/formNatStaticMap component of UTT HiPER 1250GW, triggered by manipulating the NatBind argument. The flaw can allow a remote attacker to overflow the buffer, potentially enabling arbitrary code execution. The weakness corresponds to CWE‑119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE‑120 (Buffer Copy without Checking Size of Input).

Affected Systems

UTT HiPER 1250GW firmware versions up to 3.2.7‑210907‑180535 are vulnerable. This includes all installations of the hardware unit running the affected firmware and any devices that rely on the formNatStaticMap functionality.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating a high severity. No EPSS score is reported, and it is not listed in the CISA KEV catalog, but the exploit is public and can be executed remotely by manipulating NatBind. Attackers with network access to the device’s administrative interface can trigger the overflow and may gain code execution.

Generated by OpenCVE AI on April 5, 2026 at 15:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to a version newer than 3.2.7‑210907‑180535.
  • If an upgrade is not immediately possible, restrict external access to the '/goform/formNatStaticMap' endpoint or block the NatBind parameter using a firewall or access control.
  • Monitor system logs for anomalous access attempts or unexpected behavior on the device.

Generated by OpenCVE AI on April 5, 2026 at 15:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared Utt
Utt hiper 1250gw
Vendors & Products Utt
Utt hiper 1250gw

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBind results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Title UTT HiPER 1250GW formNatStaticMap strcpy buffer overflow
Weaknesses CWE-119
CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1250gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-06T15:27:48.716Z

Reserved: 2026-04-04T14:19:03.601Z

Link: CVE-2026-5566

cve-icon Vulnrichment

Updated: 2026-04-06T15:27:42.992Z

cve-icon NVD

Status : Deferred

Published: 2026-04-05T13:17:14.520

Modified: 2026-04-24T18:14:34.620

Link: CVE-2026-5566

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-06T21:56:47Z

Weaknesses