UTT HiPER 1250GW CVE-2026-18897

Exploitation requires authenticated access to the UTT HiPER 1250GW web management interface, as confirmed by PR:L in the CVSS 4.0 vector - an attacker must hold valid credentials or have hijacked an authenticated session before reaching the vulnerable endpoint. The specific trigger is an HTTP request to /goform/getOneApConfTempEntry with an oversized tempName argument; no non-default configuration or special device mode is required beyond the management web interface being reachable. The primary factor limiting exploitation is this authentication prerequisite (PR:L): an unauthenticated remote attacker cannot directly trigger the overflow without first obtaining credentials. Network-level access control restricting the management interface to trusted subnets would prevent remote exploitation entirely. All firmware versions up to and including v3.2.7-210907-180535 on any deployment of this device are susceptible.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) yields a score of 7.4, reflecting a network-reachable, low-complexity attack path constrained only by a low-privilege authentication requirement. The E:P supplemental metric in the provided vector explicitly acknowledges the existence of public exploit code, which is corroborated by the GitHub PoC reference. This meaningfully raises real-world risk beyond the base score: a motivated attacker with any valid credential can weaponize the public PoC. The absence of a CISA KEV entry means mass or nation-state exploitation has not been publicly confirmed, but the PoC lowers the skill bar considerably. The vendor's non-response to disclosure eliminates any expectation of an imminent patch, making compensating controls the only available mitigation path. The primary risk limiter is the PR:L authentication requirement - without valid credentials or session hijacking capability, remote unauthenticated exploitation is not confirmed by the available data.

An attacker with low-privilege credentials to the HiPER 1250GW management interface - obtained via default credentials, credential stuffing, or prior compromise - sends a crafted HTTP POST to /goform/getOneApConfTempEntry with a tempName value exceeding the stack buffer size. The unsafe strcpy call overwrites the return address with attacker-controlled data; when the function returns, execution is redirected to attacker-supplied code or a ROP chain. A public proof-of-concept demonstrating this technique is available at https://github.com/7wkajk/CVE-VUL/blob/main/102.md, reducing the expertise required for exploitation.