UTT HiPER 1200GW CVE-2026-18898

Exploitation requires network access to the HiPER 1200GW web management HTTP/HTTPS interface and possession of valid low-privilege credentials (confirmed by CVSS 4.0 PR:L). The vulnerable handler /goform/ConfigAdvideo must be reachable from the attacker's network position - if the management interface is restricted to LAN-only access, exploitation from external networks is blocked. No special firmware feature toggle or non-default configuration is required beyond basic management portal access. The key limiting factor is the authentication requirement: unauthenticated exploitation is not supported by the CVSS vector. However, many SMB/SOHO devices ship with default or weak credentials, which effectively lowers this barrier in practice. No specific platform dependency beyond the affected firmware version is documented.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) establishes a high-severity, low-complexity, network-reachable flaw requiring only low-privilege credentials with no user interaction. The E:P supplemental metric confirms a public exploit exists, directly corroborating the GitHub PoC reference. This combination - high CVSS impact, low complexity, low authentication bar, and a publicly released exploit - represents a materially elevated real-world risk rather than a theoretical one. No CISA KEV listing was identified at time of analysis, so confirmed active mass exploitation is not established; however, given PoC availability and the vendor's complete non-response to disclosure (meaning no patch is forthcoming), any deployed instance reachable from untrusted networks should be treated as critically exposed. The absence of a patch path makes compensating controls the only available mitigation, further elevating operational risk.

An attacker who has obtained low-privilege credentials to the HiPER 1200GW web management interface - through credential stuffing, default credentials, or prior compromise - sends a crafted HTTP POST request to /goform/ConfigAdvideo containing an oversized timestart parameter value. The unguarded strcpy call copies the oversized value onto the stack, overwriting the function's return address with an attacker-controlled value. A public proof-of-concept exploit is available on GitHub, significantly lowering the technical barrier, and the device is then fully compromised with the ability to modify routing, intercept traffic, or pivot to internal network resources.