Description
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Published: 2026-08-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

A buffer overflow flaw exists in the UTT HiPER 1200GW firmware, located in the strcpy call within the /goform/formConfigFastDirectionW file. Manipulating the ssid argument allows an attacker to overflow a local buffer, which can result in unpredictable device behavior or a crash. The vulnerability is classified under CWE-119 and CWE-120 and is most severe when the ssid string exceeds the buffer’s capacity.

Affected Systems

This issue affects UTT HiPER 1200GW firmware versions up to 2.5.3-170306. Any deployed device running an affected firmware build is vulnerable to remote exploitation if it accepts external ssid input through the formConfigFastDirectionW interface.

Risk and Exploitability

The CVSS score of 8.7 indicates a high risk to confidentiality, integrity, and availability. No EPSS information is presently available, but published exploits demonstrate that the flaw can be triggered remotely without special privileges. The vulnerability is not listed in the CISA KEV catalog, yet its remote nature and the existence of a public exploit make it a serious concern.

Generated by OpenCVE AI on August 24, 2026 at 03:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the device firmware to a version released after 2.5.3-170306 that removes the vulnerable strcpy call.
  • If an update is not immediately possible, restrict external access to the /goform/formConfigFastDirectionW endpoint through firewall rules or network segmentation.
  • Implement input validation on the ssid parameter to enforce a maximum string length before invoking any string-handling functions, thereby preventing buffer overflow attempts.

Generated by OpenCVE AI on August 24, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.
Title UTT HiPER 1200GW formConfigFastDirectionW strcpy buffer overflow
First Time appeared Utt
Utt hiper 1200gw
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:utt:hiper_1200gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1200gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1200gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-24T17:17:51.598Z

Reserved: 2026-08-23T14:20:07.393Z

Link: CVE-2026-78170

cve-icon Vulnrichment

Updated: 2026-08-24T17:17:45.524Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T02:17:04.817

Modified: 2026-08-24T18:17:27.187

Link: CVE-2026-78170

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T04:00:12Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')