UTT HiPER 840G CVE-2025-11305

Exploitation requires network access to the HiPER 840G web management interface and an authenticated session with at least low privileges (CVSS PR:L), after which a crafted request to the /goform/formTaskEdit endpoint with an overlong txtMin2 argument triggers the strcpy buffer overflow. No user interaction is needed (UI:N). Limiting factors: the attacker must reach the management interface (typically LAN-side or an exposed/forwarded admin port) and must hold valid credentials or a valid session, so devices that do not expose management to untrusted networks and that restrict accounts are substantially less at risk. The affected products are limited to UTT HiPER 840G firmware up to 3.1.1-190328.

Signals are moderate and largely consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity flaw that nonetheless requires authentication (PR:L), and the provided base score is 7.4 with high VC/VI/VA impact. A public exploit exists (referenced GitHub issue), but EPSS is only 0.97% (61st percentile), and there is NO CISA KEV listing - so exploitation is publicly available exploit code exists rather than confirmed active exploitation. The combination of a low-privilege auth requirement, a niche embedded router product, and low EPSS suggests this is a genuine but not widespread-priority issue: opportunistic or targeted exploitation against exposed/authenticated management interfaces rather than mass exploitation. Note the vector carries E:P (Proof-of-Concept), aligning with the POC signal. The vendor was contacted but did not respond, so no official patch is confirmed, which raises the practical risk for exposed devices despite the modest EPSS.

An attacker with low-privilege access to the HiPER 840G web management interface sends a crafted request to /goform/formTaskEdit with an oversized txtMin2 argument, overflowing a fixed buffer via an unsafe strcpy. Because public exploit code has been disclosed, a low-skill attacker can reproduce this to crash the device or potentially execute code on the router. Exploitation is network-reachable but gated by the need for valid low-level credentials or an authenticated session.