810g Firmware CVE-2026-31061

Real-world risk is constrained by multiple limiting factors. The CVSS vector (AV:A/AC:L/PR:H/UI:N/S:U) indicates attack surface is limited to the adjacent network (AV:A), requires high-level administrative or root privileges (PR:H), has low attack complexity, but causes high availability impact. EPSS data is unavailable; however, exploitation probability is naturally low because the attack requires both network adjacency and high privilege-this rules out external attackers and most internal threat actors. No public exploit code or CISA KEV status was identified, indicating this is not a widespread active threat. The vulnerability is effectively a local privilege escalation or lateral movement risk only within trusted network segments where authenticated administrative access already exists. Organizations should prioritize other vulnerabilities with broader attack surfaces.

An authenticated administrator (or insider with high privileges) on a network segment adjacent to the UTT HiPER 810G v3 device crafts a POST or configuration request with an oversized timestart parameter targeting the ConfigAdvideo function. The buffer overflow corrupts process memory, causing the video configuration service or the entire device to crash, resulting in loss of surveillance recording or streaming until manual restart. Because high privilege and adjacent network access are required, this is not an external threat vector and would typically occur only in scenarios of insider abuse or lateral movement after an attacker has already compromised a trusted administrative account.