Description
A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Published: 2026-08-19
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness has been identified in UTT HiPER 1200GW firmware versions up to 2.5.3-170306 that involves the strcpy function in the /goform/formGroupConfig module. Manipulating the timestart argument can cause a stack-based buffer overflow, potentially allowing attackers to overwrite stack memory. This overflow is a CWE-119 and CWE-121 vulnerability. While the documentation states that the flaw could be used for attacks, it does not explicitly confirm arbitrary code execution; based on the type of overflow, it is inferred that an attacker could gain arbitrary code execution capability.

Affected Systems

UTT’s HiPER 1200GW network appliances running firmware versions up to and including 2.5.3-170306 are vulnerable. No newer revisions are listed as affected, so users should verify they are on a version newer than 2.5.3-170306.

Risk and Exploitability

The CVSS score of 9.4 indicates critical severity. EPSS data is not available. The vulnerability can be triggered from remote over the web interface, and a public exploit has been released, implying a tangible risk. The device is not listed in CISA’s KEV catalog, but the combination of remote attack vector and publicly available exploit elevates the urgency of remediation.

Generated by OpenCVE AI on August 19, 2026 at 07:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a firmware update newer than 2.5.3-170306 to eliminate the vulnerable strcpy implementation.
  • If an immediate update is not possible, restrict or block remote access to the formGroupConfig API, for example by applying firewall rules or IP whitelisting.
  • Monitor device logs for anomalous timestart parameters or failed write attempts that could indicate exploitation attempts.

Generated by OpenCVE AI on August 19, 2026 at 07:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Title UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow
First Time appeared Utt
Utt hiper 1200gw
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:utt:hiper_1200gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1200gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Utt Hiper 1200gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-19T02:00:11.106Z

Reserved: 2026-08-18T18:49:09.139Z

Link: CVE-2026-76003

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T03:16:52.727

Modified: 2026-08-19T03:16:52.727

Link: CVE-2026-76003

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T07:30:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow