Which versions of UTT HiPER 1200GW are affected by CVE-2026-10293?

A stack-based buffer overflow vulnerability (CVSS 7.4) in UTT HiPER 1200GW network routers enables authenticated remote attackers to corrupt device memory through the /goform/formFireWall endpoint,…

Is there a public PoC exploit available for CVE-2026-10293?

Yes, a public proof-of-concept exploit is available for CVE-2026-10293. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-10293?

24 hours: Identify all UTT HiPER 1200GW routers running firmware version 2.5.3-170306 or earlier; immediately restrict administrative interface access to whitelisted IP addresses of authorized administrators only; require strong, unique administrative credentials with immediate password changes. 7 days: Implement network segmentation isolating router management interfaces on a separate administrative VLAN; deploy IDS/IPS detection rules targeting /goform/formFireWall endpoint access patterns; configure centralized logging and alerting for all management authentication attempts and Profile parameter submissions. 30 days: Contact UTT for security patch or end-of-life replacement guidance; evaluate transition to alternative router models with active vendor security maintenance; conduct full vulnerability reassessment of any remaining affected devices.

UTT HiPER 1200GW CVE-2026-10293

Q: What is the CVSS score of CVE-2026-10293?

CVE-2026-10293 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33816 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-01 VulDB

GHSA-v9p3-mv8f-2rq8

Buffer Overflow Stack Overflow Hiper 1200Gw

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 01, 2026 - 22:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 01, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 01, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jun 01, 2026 - 22:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 01, 2026 - 22:15 vuln.today

DescriptionCVE.org

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/formFireWall. This manipulation of the argument Profile causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory via the Profile parameter in the /goform/formFireWall endpoint, where unsafe strcpy usage processes the input. Publicly available exploit code exists, increasing the realistic risk of attempted compromise against exposed management interfaces. No CISA KEV listing has been published, so exploitation is not yet confirmed active in the wild.

Technical ContextAI

The affected product (cpe:2.3:a:utt:hiper_1200gw) is a small/medium business router from UTT Technologies whose web administration interface exposes /goform/* handlers - a common pattern in embedded Boa/GoAhead-style HTTP servers used in SOHO routers. The root cause maps to CWE-121 (stack-based buffer overflow): the Profile argument is passed directly to strcpy() with no length validation, so any input longer than the fixed destination buffer overwrites adjacent stack memory, including saved return addresses. On MIPS/ARM embedded firmware that typically lacks modern mitigations (no ASLR, no stack canaries, often no NX), this class of bug routinely allows arbitrary code execution via ROP or shellcode injection.

RemediationAI

No vendor-released patch identified at time of analysis - UTT has not published an advisory or fixed firmware version in the references provided, so defenders should monitor https://www.utt.com.cn for firmware later than 2.5.3-170306. As compensating controls, restrict access to the router web management interface (/goform/formFireWall) to a trusted management VLAN or specific admin source IPs via ACL, and disable WAN-side administration entirely if enabled (trade-off: remote admin convenience is lost). Enforce strong, unique administrator credentials and rotate them, since the PR:L requirement means credential compromise is the precondition for exploitation. As a higher-impact fallback, replace the device with a vendor-supported router if UTT does not publish a fix, since SOHO firmware bugs of this class are rarely patched promptly.