Skip to main content

UTT HiPER 1250GW CVE-2026-18895

| EUVDEUVD-2026-53019 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-08-05 VulDB GHSA-gpvf-48jp-phv5
Buffer Overflow Stack Overflow Hiper 1250Gw
7.4
CVSS 4.0 · Vendor: VulDB
Share

Severity by source

Vendor (VulDB) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable management endpoint (AV:N), trivial to trigger once authenticated (AC:L), low privilege required per CVSS 4.0 input (PR:L), no scope change as impact is contained to the device process (S:U), full CIA impact from arbitrary code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 05, 2026 - 02:28 vuln.today
CVSS changed
Aug 05, 2026 - 02:22 NVD
8.7 (HIGH) 7.4 (HIGH)
CVE Published
Aug 05, 2026 - 01:30 cve.org
HIGH 7.4

DescriptionCVE.org

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stack-based buffer overflow in UTT HiPER 1250GW firmware (all versions through 3.2.7-210907-180535) enables low-privileged remote attackers to corrupt stack memory and achieve arbitrary code execution by submitting an oversized value to the cipher parameter of the /goform/APSecurity_5g endpoint. A public proof-of-concept exploit is available on GitHub, materially increasing opportunistic abuse risk. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify exposed UTT HiPER 1250GW management interface
Delivery
Authenticate with default or compromised credentials
Exploit
Submit crafted HTTP POST to /goform/APSecurity_5g
Execution
Supply oversized cipher argument exceeding stack buffer
Persist
Overflow triggers strcpy overwrite of return address
Impact
Redirect execution to attacker-controlled code on device
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network-level reachability of the UTT HiPER 1250GW management web interface and a valid low-privilege authenticated session (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 7.4 reflects network-accessible exploitation (AV:N) with low complexity (AC:L), no additional attack requirements (AT:N), low privilege (PR:L), no user interaction (UI:N), and full impact on the vulnerable system's confidentiality, integrity, and availability (VC:H/VI:H/VA:H), with no lateral impact on subsequent systems (SC:N/SI:N/SA:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained low-privilege credentials to the UTT HiPER 1250GW management interface - through default factory credentials, credential stuffing, or phishing - sends a crafted HTTP POST request to /goform/APSecurity_5g with a cipher parameter value exceeding the fixed stack buffer size. The unsafe strcpy call overwrites the return address on the stack, and upon function return, execution is redirected to attacker-controlled shellcode or a ROP gadget chain. …
Remediation No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all UTT HiPER 1250GW devices in your environment and confirm firmware versions against the affected range (through 3.2.7-210907-180535); immediately isolate critical devices from production networks or place on restricted management VLAN. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Hiper 1250Gw

View all
CVE-2026-78169 HIGH POC
8.6 Aug 24

Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execu
CVE-2026-76004 HIGH POC
8.6 Aug 19

Stack-based buffer overflow in UTT HiPER 1250GW firmware (versions through 3.2.7-210907-180535) allows remote, low-privi
CVE-2026-18897 HIGH POC
7.4 Aug 05

Stack-based buffer overflow in the UTT HiPER 1250GW firmware (all versions up to v3.2.7-210907-180535) allows authentica
CVE-2026-14721 HIGH POC
7.4 Jul 05

Stack-based buffer overflow in the UTT HiPER 1250GW SOHO router (firmware through 3.2.7-210907-180535) lets a network-ad
CVE-2026-7420 HIGH POC
7.4 Apr 29

Remote code execution risk in the UTT HiPER 1250GW router (firmware up to 3.2.7-210907-180535) stems from an unbounded s
CVE-2026-7419 HIGH POC
7.4 Apr 29

Stack buffer overflow in the UTT HiPER 1250GW gateway/router (firmware up to 3.2.7-210907-180535) lets a low-privileged

CVE-2026-7418 HIGH POC
7.4 Apr 29

Stack buffer overflow in the UTT HiPER 1250GW enterprise router (firmware up to 3.2.7-210907-180535) allows an authentic
CVE-2026-5566 HIGH POC
7.4 Apr 05

Buffer overflow in UTT HiPER 1250GW router firmware (versions ≤3.2.7-210907-180535) allows authenticated remote attacker
CVE-2026-5544 HIGH POC
7.4 Apr 05

Stack-based buffer overflow in UTT HiPER 1250GW router (versions up to 3.2.7-210907-180535) allows authenticated remote

CVE-2026-4862 HIGH POC
7.4 Mar 26

Buffer overflow in UTT HiPER 1250GW firmware versions up to 3.2.7-210907-180535 allows authenticated remote attackers to
CVE-2026-4488 HIGH POC
7.4 Mar 20

Remote code execution in UTT HiPER 1250GW firmware versions up to 3.2.7 allows authenticated attackers to overflow a buf

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

CVE-2026-18895 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy