Description
A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/formConfigFastDirectionW of the component Web Management Interface. Performing a manipulation of the argument Profile results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Published: 2026-05-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack-based buffer overflow exists in the UTT HiPER 1250GW Web Management interface, specifically in the strcpy call within the /goform/formConfigFastDirectionW component. Manipulating the Profile argument can overflow the stack, and based on the description, it is inferred that an attacker can achieve arbitrary code execution on the device. The vulnerability is identified as CWE-119 and CWE-121.

Affected Systems

Products affected include UTT HiPER 1250GW firmware versions up to 3.2.7-210907-180535. All earlier builds that use the vulnerable web management interface are susceptible, while newer firmware releases may provide a fix.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS information is not available, and the vulnerability is publicly disclosed and can be exploited remotely through the web interface. It is listed in no KEV catalog. The likely attack vector is a remote attacker submitting a crafted request containing an oversized Profile argument to the /goform/formConfigFastDirectionW endpoint.

Generated by OpenCVE AI on May 27, 2026 at 03:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the UTT HiPER 1250GW firmware to a version newer than 3.2.7-210907-180535 that addresses the buffer overflow.
  • If a newer firmware release is not yet available, disable the fast direction configuration feature through the device management interface to eliminate the vulnerable inbound path.
  • Continuously monitor web access logs for anomalous POST requests targeting /goform/formConfigFastDirectionW and apply additional intrusion detection rules if necessary.

Generated by OpenCVE AI on May 27, 2026 at 03:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 27 May 2026 01:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/formConfigFastDirectionW of the component Web Management Interface. Performing a manipulation of the argument Profile results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.
Title UTT HiPER 1250GW Web Management formConfigFastDirectionW strcpy stack-based overflow
First Time appeared Utt
Utt hiper 1250gw
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:utt:hiper_1250gw:*:*:*:*:*:*:*:*
Vendors & Products Utt
Utt hiper 1250gw
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Utt Hiper 1250gw
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-27T12:31:13.557Z

Reserved: 2026-05-26T17:48:33.182Z

Link: CVE-2026-9631

cve-icon Vulnrichment

Updated: 2026-05-27T12:31:10.299Z

cve-icon NVD

Status : Deferred

Published: 2026-05-27T02:16:35.907

Modified: 2026-06-17T11:05:33.357

Link: CVE-2026-9631

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T03:30:06Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow