A flaw in UTT HiPER 1250GW's Web Management Interface leads to a stack‑based buffer overflow when the "Profile" parameter is processed by the strcpy function in /goform/formGroupConfig. This overflow can be triggered remotely, enabling an attacker to potentially execute arbitrary code on the device. The vulnerability is classified under CWE‑119 and CWE‑121, indicating unchecked buffer copying and stack overflow exploits.

The affected product is UTT HiPER 1250GW, firmware versions up to 3.2.7‑210907‑180535. The flaw exists in the Web Management Interface component. Anyone using versions prior to this release is susceptible.

With a CVSS score of 8.7, the vulnerability is considered high severity. Although no EPSS score is available, the published exploit suggests that exploitation is feasible over the network. The vulnerability is not listed in CISA’s KEV catalog, but the fact that the exploit has already been released indicates that attackers could target affected devices if the Web Management Interface is accessible from the internet or an untrusted network.