What is the CVSS score of CVE-2026-31058?

CVE-2026-31058 has a CVSS 3.1 base score of 4.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

1200Gw Firmware CVE-2026-31058

EUVD-2026-19251 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-04-06 cve@mitre.org

GHSA-w2w6-945r-j84p

Buffer Overflow Denial Of Service 1200Gw Firmware Utt

4.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.5 MEDIUM

AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19251

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

MEDIUM 4.5

DescriptionCVE.org

UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of the formConfigDnsFilterGlobal function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Buffer overflow in UTT Aggressive HiPER 1200GW v2.5.3-170306 timeRangeName parameter allows authenticated attackers with high privileges to cause denial of service through crafted input to the formConfigDnsFilterGlobal function. CVSS score of 4.5 reflects local/adjacent network attack vector and high-privilege requirement, with no confidentiality or integrity impact. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability is a classic buffer overflow (CWE-120: Buffer Copy without Checking Size of Input) in the timeRangeName parameter handler of the formConfigDnsFilterGlobal function within UTT Aggressive HiPER 1200GW network device firmware. The affected product is a broadband gateway/router (CPE prefix: cpe:2.3:h:utt:aggressive_hiper_1200gw) running firmware version 2.5.3-170306. The root cause is improper input validation and bounds checking on a string parameter, allowing an attacker to write beyond allocated buffer boundaries. When triggered via the DNS filter configuration interface, this overflow can corrupt adjacent memory structures, leading to process crash or unexpected behavior.

RemediationAI

Contact UTT Technologies or consult the official product advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-31058 to determine if a patched firmware version is available. If a patched firmware release exists, update the device to the latest stable firmware version through the device's administrative interface or management console. As an interim mitigation, restrict access to the DNS filter configuration interface (formConfigDnsFilterGlobal function) to trusted administrators only and segment the network to limit adjacent network access to the affected gateway device. Disable administrative access from untrusted network segments and enforce strong authentication credentials for all administrative accounts with access to the device configuration interface. Monitor device logs for unexpected configuration changes or crashes that may indicate exploitation attempts.