UTT HiPER 1250GW CVE-2026-14721

Exploitation requires network access to the UTT HiPER 1250GW web management endpoint /goform/ConfigWirelessBase_5g and the ability to submit the 'ssid' parameter to the 5 GHz wireless base configuration handler. The CVSS vector specifies PR:L, meaning low-level privileges (authenticated access to the web UI) are expected, and UI:N means no victim interaction is needed. Limiting factors: the attacker must be able to reach the management interface (mitigated when WAN-side management is disabled and the UI is confined to the LAN or a management VLAN), must hold at least low-privilege web-UI credentials per the PR:L rating, and the target must be running firmware at or below 3.2.7-210907-180535. Note the description states remote exploitation without explicitly citing authentication, which is in tension with PR:L - confirm the actual auth requirement with the vendor.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a low-complexity, remotely reachable attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the device itself (no scope change to downstream systems). Publicly available exploit code raises practical risk, but this is NOT CISA KEV-listed and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the signal is 'PoC exists' rather than 'exploited.' The PR:L requirement is the key mitigating factor: exploitation presupposes the attacker can reach and authenticate to (or otherwise interact with) the web management endpoint, which on a properly deployed router should not be exposed to the internet. Real-world priority is moderate: high technical impact and a working PoC, tempered by low product prevalence, required web-UI access, and no confirmed exploitation. Note the vector's PR:L conflicts with the description's phrasing that 'the attack is possible remotely' with no mention of credentials - verify with the vendor whether the endpoint is reachable pre-authentication, which would materially raise severity.

An attacker who can reach the router's web management interface - for example on an internet-exposed device or from within the LAN with low-level web-UI access - submits a crafted POST to /goform/ConfigWirelessBase_5g with an oversized 'ssid' value. The overlong string overflows a fixed-size stack buffer, overwriting the saved return address to crash the device (denial of service) or, with a tailored payload, redirect execution to attacker-controlled shellcode. A public PoC for this exact endpoint is available on GitHub, lowering the effort required to reproduce the attack.