EUVD-2026-33816
GHSA-v9p3-mv8f-2rq8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed HiPER 1200GW admin interface
-
DeliveryObtain admin credentials (default/weak/reuse)
-
ExploitAuthenticate to web UI
-
InstallSend crafted POST to /goform/formFireWall with oversized Profile
-
C2Overflow stack via strcpy and hijack return address
-
ExecuteExecute shellcode/ROP as router process
-
ImpactPersist on device for LAN pivot or traffic interception
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the router's HTTP administration interface, typically the LAN side by default but the WAN side if remote management is enabled, and (2) valid authenticated access at admin/operator level (CVSS PR:L) sufficient to reach the /goform/formFireWall handler. The specific trigger is supplying an overlong value in the Profile parameter to that endpoint on firmware at or below 2.5.3-170306. Limiting factors: no user interaction is needed once authenticated (UI:N), but pre-auth exploitation is not described, so realistic risk concentrates on devices with default/weak credentials, exposed WAN admin interfaces, or attackers who have already obtained an admin session. |
| Impact | Signals are mixed and moderate. The CVSS 4.0 vector AV:N/AC:L/PR:L/UI:N with full VC:H/VI:H/VA:H gives 7.4, reflecting network reach but requiring authentication (PR:L) - a critical filter that limits opportunistic mass exploitation. The E:P (Proof-of-Concept) flag plus the published GitHub exploit confirm working code exists. There is no EPSS score, no CISA KEV listing, and no SSVC decision provided in the input - so automation potential and observed exploitation cannot be cited as confirmed. Realistically this is a targeted-risk issue: routers with internet-exposed admin panels and weak/default credentials are at meaningful risk because PR:L is trivially satisfied once admin creds are guessed or harvested, but a fully unauthenticated mass-exploit path is not described. Reporter is VulDB only; no independent vendor confirmation is present in the data. |
| Exploit ScenarioDerived | An attacker who has obtained or guessed valid administrator credentials (e.g., default creds, phishing, or credential reuse) sends a crafted HTTP POST to /goform/formFireWall with an oversized Profile parameter; the strcpy overflows the stack and overwrites the return address, redirecting execution to attacker-supplied shellcode or a ROP chain. The published PoC at github.com/yuezhaoshanmu/cve lowers the barrier to weaponization, enabling persistent backdoor installation on the router for traffic interception or pivoting into the LAN. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory via the Profile parameter in the /goform/formFireWall endpoint, where unsafe strcpy usage processes the input. Publicly available exploit code exists, increasing the realistic risk of attempted compromise against exposed management interfaces. No CISA KEV listing has been published, so exploitation is not yet confirmed active in the wild.
Earlier versions of this analysis (2)
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware versions up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory by submitting an oversized Profile parameter to the /goform/formFireWall endpoint. Publicly available exploit code exists, and the CVSS 4.0 score of 7.4 reflects high impact to confidentiality, integrity, and availability via the network attack vector. No CISA KEV listing is present, but the combination of a published PoC and a low-complexity network-reachable web endpoint elevates real-world risk for exposed devices.
Stack-based buffer overflow in UTT HiPER 1200GW routers (versions up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory and likely achieve code execution by submitting a crafted Profile argument to the /goform/formFireWall endpoint, which passes the value to an unsafe strcpy call. Publicly available exploit code exists per VulDB, raising the practical risk despite no CISA KEV listing at this time. The CVSS 8.8 (High) score reflects network reachability, low complexity, and full confidentiality/integrity/availability impact once low-privilege access is obtained.
RemediationAI
No vendor-released patch identified at time of analysis - UTT has not published an advisory or fixed firmware version in the references provided, so defenders should monitor https://www.utt.com.cn for firmware later than 2.5.3-170306. As compensating controls, restrict access to the router web management interface (/goform/formFireWall) to a trusted management VLAN or specific admin source IPs via ACL, and disable WAN-side administration entirely if enabled (trade-off: remote admin convenience is lost). Enforce strong, unique administrator credentials and rotate them, since the PR:L requirement means credential compromise is the precondition for exploitation. As a higher-impact fallback, replace the device with a vendor-supported router if UTT does not publish a fix, since SOHO firmware bugs of this class are rarely patched promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product (cpe:2.3:a:utt:hiper_1200gw) is a small/medium business router from UTT Technologies whose web administration interface exposes /goform/* handlers - a common pattern in embedded Boa/GoAhead-style HTTP servers used in SOHO routers. The root cause maps to CWE-121 (stack-based buffer overflow): the Profile argument is passed directly to strcpy() with no length validation, so any input longer than the fixed destination buffer overwrites adjacent stack memory, including saved return addresses. On MIPS/ARM embedded firmware that typically lacks modern mitigations (no ASLR, no stack canaries, often no NX), this class of bug routinely allows arbitrary code execution via ROP or shellcode injection.
Know when Hiper 1200Gw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/formFireWall. This manipulation of the argument Profile causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Executive ViewAI
A stack-based buffer overflow vulnerability (CVSS 7.4) in UTT HiPER 1200GW network routers enables authenticated remote attackers to corrupt device memory through the /goform/formFireWall endpoint, with publicly available exploit code existing. Organizations operating these routers face potential loss of network device availability and unauthorized network access if administrative interfaces remain exposed to untrusted networks. The absence of a vendor-released patch necessitates immediate implementation of compensating controls to reduce exposure.
Restrict administrative interface (all management protocols) to whitelisted IP addresses of authorized administrators; disable remote management access if operationally unnecessary; implement network segmentation with management interfaces on isolated administrative network; deploy IDS/IPS signatures for /goform/formFireWall exploitation attempts; enforce multi-factor authentication for administrative access; enable comprehensive logging and centralized monitoring of router management sessions; establish automated alerts for failed authentication attempts and unusual parameter submissions; implement weekly access log review process; establish vendor contact protocol for firmware security update notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Hiper 1200Gw
View allStack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via
Stack-based buffer overflow in UTT HiPER 1200GW firmware up to v2.5.3-170306 enables network-reachable authenticated att
Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote atta
Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware versions up to 2.5.3-170306) allows remote authenticat
Buffer overflow in UTT HiPER 1200GW router versions up to 2.5.3-170306 enables remote authenticated attackers to execute
Unauthenticated attackers can trigger a buffer overflow in UTT HiPER 1200GW firmware versions up to 2.5.3-170306 via the
Exploit-DB