Skip to main content

UTT HiPER 1250GW CVE-2026-14721

| EUVDEUVD-2026-41734 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-05 VulDB GHSA-497j-pwp3-mjvj
Buffer Overflow Stack Overflow Hiper 1250Gw
7.4
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable web endpoint with low-complexity overflow; PR:L reflects expected web-UI authentication; stack overflow yields high C/I/A on the device with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 05, 2026 - 08:31 vuln.today
CVSS changed
Jul 05, 2026 - 08:22 NVD
8.7 (HIGH) 7.4 (HIGH)

DescriptionCVE.org

A vulnerability has been found in UTT HiPER 1250GW up to 3.2.7-210907-180535. This affects an unknown function of the file /goform/ConfigWirelessBase_5g of the component Web Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Stack-based buffer overflow in the UTT HiPER 1250GW SOHO router (firmware through 3.2.7-210907-180535) lets a network-adjacent attacker corrupt memory by supplying an oversized 'ssid' argument to the /goform/ConfigWirelessBase_5g web handler, potentially achieving code execution or a device crash. The flaw is remotely reachable via the device's web management interface and carries a CVSS 4.0 base score of 7.4 (PR:L, indicating some authentication to the web UI is expected). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach router web management interface
Delivery
Authenticate with low-privilege credentials
Exploit
POST oversized ssid to /goform/ConfigWirelessBase_5g
Execution
Overflow fixed-size stack buffer
Persist
Overwrite saved return address
Impact
Execute payload or crash device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network access to the UTT HiPER 1250GW web management endpoint /goform/ConfigWirelessBase_5g and the ability to submit the 'ssid' parameter to the 5 GHz wireless base configuration handler. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a low-complexity, remotely reachable attack requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the device itself (no scope change to downstream systems). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the router's web management interface - for example on an internet-exposed device or from within the LAN with low-level web-UI access - submits a crafted POST to /goform/ConfigWirelessBase_5g with an oversized 'ssid' value. The overlong string overflows a fixed-size stack buffer, overwriting the saved return address to crash the device (denial of service) or, with a tailored payload, redirect execution to attacker-controlled shellcode. …
Remediation No vendor-released patch identified at time of analysis, and no fixed firmware version is cited in the available data - check the UTT vendor portal for an updated HiPER 1250GW firmware release superseding 3.2.7-210907-180535 and apply it once available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all UTT HiPER 1250GW deployments and verify firmware versions through 3.2.7-210907-180535 are in use; immediately restrict web management interface access to defined trusted administrative networks via firewall rules and access controls. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hiper 1250Gw

View all
CVE-2026-7420 HIGH POC
7.4 Apr 29

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of th
CVE-2026-7419 HIGH POC
7.4 Apr 29

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of

CVE-2026-7418 HIGH POC
7.4 Apr 29

A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function st
CVE-2026-5566 HIGH POC
7.4 Apr 05

Buffer overflow in UTT HiPER 1250GW router firmware (versions ≤3.2.7-210907-180535) allows authenticated remote attacker
CVE-2026-5544 HIGH POC
7.4 Apr 05

Stack-based buffer overflow in UTT HiPER 1250GW router (versions up to 3.2.7-210907-180535) allows authenticated remote

CVE-2026-4862 HIGH POC
7.4 Mar 26

Buffer overflow in UTT HiPER 1250GW firmware versions up to 3.2.7-210907-180535 allows authenticated remote attackers to
CVE-2026-4488 HIGH POC
7.4 Mar 20

Remote code execution in UTT HiPER 1250GW firmware versions up to 3.2.7 allows authenticated attackers to overflow a buf

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.0
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2026-14721 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy