Description
A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web Management Interface. The manipulation of the argument sysAdmUser/sysAdmPass results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Published: 2026-05-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A buffer overflow flaw exists in the Web Management Interface of UTT HiPER 1200GW devices up to version 2.5.3-170306. The vulnerability arises when the sysAdmUser or sysAdmPass parameters supplied to the /goform/setSysAdm API are not adequately bounded, allowing an attacker to overwrite memory via the C string function strcpy, which can lead to arbitrary code execution or system compromise. This flaw is a Classic Buffer Overflow (CWE-119) and a Stack-based Buffer Overflow (CWE-120).

Affected Systems

UTT HiPER 1200GW devices running firmware up to 2.5.3‑170306. No other product versions are listed in the advisory, so older or newer releases may be unaffected. Administrators should verify the exact firmware version and compare it against the affected range.

Risk and Exploitability

The reported CVSS score of 8.7 indicates high severity, and public exploit code has been released, confirming that the vulnerability can be leveraged remotely over the network. Although the EPSS score is not available, the existence of a public exploit and the remote nature of the attack suggest a high likelihood of exploitation in environments where the device is exposed to untrusted networks. The vulnerability is not currently listed in the CISA KEV catalog, but the widespread availability of exploit code means that attackers could target any exposed device without prior knowledge of the specific firmware version.

Generated by OpenCVE AI on May 27, 2026 at 02:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest firmware update from UTT that addresses the strcpy buffer overflow in the Web Management Interface.
  • If no update is immediately available, disable the Web Management Interface or limit its exposure to trusted local IP ranges to block remote exploitation.
  • Enforce strong, unique passwords for all administrative accounts (sysAdmUser/sysAdmPass) and consider enabling two‑factor authentication if supported by the device.
  • Regularly review system logs for abnormal login attempts or unauthorized admin activity and set up alerts to detect potential compromise.

Generated by OpenCVE AI on May 27, 2026 at 02:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 27 May 2026 01:30:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/setSysAdm of the component Web Management Interface. The manipulation of the argument sysAdmUser/sysAdmPass results in buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Title UTT HiPER 1200GW Web Management setSysAdm strcpy buffer overflow
First Time appeared Utt
Utt hiper 1200gw
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:utt:hiper_1200gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1200gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1200gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-27T14:27:55.205Z

Reserved: 2026-05-26T17:25:29.671Z

Link: CVE-2026-9627

cve-icon Vulnrichment

Updated: 2026-05-27T14:27:51.216Z

cve-icon NVD

Status : Deferred

Published: 2026-05-27T02:16:35.583

Modified: 2026-06-17T11:05:33.010

Link: CVE-2026-9627

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T02:30:05Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')