EUVD-2026-12576Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to UTT HiPER 810G
-
DeliverySend POST request to /goform/formApLbConfig
-
ExploitCraft oversized loadBalanceNameOld parameter
-
ExecutionOverflow strcpy buffer
-
ImpactExecute arbitrary code with device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | UTT HiPER 810G firmware version 1.7.7-171114 or earlier with valid user credentials for web interface access; requires authentication to the /goform/formApLbConfig endpoint. |
| Impact | This vulnerability presents a high real-world risk based on multiple factors. The CVSS 3.1 score of 8.8 (High) reflects network-based attack vector with low complexity and low privilege requirements, meaning any authenticated user can exploit it remotely without user interaction. The public availability of a proof-of-concept exploit on GitHub dramatically increases the likelihood of exploitation. While the vulnerability requires authentication (PR:L), this is often a minimal barrier in router environments where default credentials are common or where an attacker has already gained initial access. The technical impact is severe (C:H/I:H/A:H), allowing complete compromise of the device. The combination of public exploit code, low exploitation complexity, and high impact makes this a priority for immediate patching despite the authentication requirement. |
| Exploit ScenarioDerived | An attacker with low-privileged credentials to the router's web interface sends a specially crafted HTTP request to /goform/formApLbConfig containing an oversized value in the loadBalanceNameOld parameter. The excessive data overflows the buffer, allowing the attacker to overwrite memory and potentially execute arbitrary code with router privileges. Given the publicly available proof-of-concept exploit and low attack complexity, this vulnerability could be weaponized quickly by attackers seeking to compromise network infrastructure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
Remote code execution in UTT HiPER 810G up to version 1.7.7-171114 through a buffer overflow in the /goform/formApLbConfig endpoint allows authenticated attackers to achieve complete system compromise. The vulnerability stems from unsafe use of strcpy() on the loadBalanceNameOld parameter, and public exploit code is currently available. No patch has been released for affected devices.
Earlier versions of this analysis (1)
A buffer overflow vulnerability exists in the UTT HiPER 810G router firmware through version 1.7.7-171114, specifically in the strcpy function within the /goform/formApLbConfig file handler. An authenticated remote attacker can exploit this vulnerability by manipulating the loadBalanceNameOld parameter to achieve complete system compromise with high impact to confidentiality, integrity, and availability. A proof-of-concept exploit has been publicly disclosed on GitHub, significantly increasing the risk of exploitation in the wild.
RemediationAI
Upgrade UTT HiPER 810G firmware to a version newer than 1.7.7-171114 as soon as possible, though no specific patched version has been explicitly identified in the available references. Until a patch can be applied, implement network segmentation to restrict access to the router's management interface to trusted IP addresses only, disable remote management if not required, and ensure strong authentication credentials are in use. Monitor logs for suspicious activity targeting the /goform/formApLbConfig endpoint. Additional vulnerability details can be found at https://vuldb.com/?id.351362 and the proof-of-concept at https://github.com/xiaoheshang404/cve/issues/1#issue-4026284809.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects UTT HiPER 810G routers (CPE: cpe:2.3:a:utt:hiper_810g:*:*:*:*:*:*:*:*) running firmware version 1.7.7-171114 and earlier. The root cause is a classic buffer overflow (CWE-120) where the strcpy function copies user-controlled input from the loadBalanceNameOld parameter without proper bounds checking into a fixed-size buffer. This occurs in the web interface's load balancing configuration handler at /goform/formApLbConfig, making it accessible through the router's HTTP management interface. Buffer overflows in network devices are particularly dangerous as they often run with elevated privileges and can lead to complete device takeover.
Know when Hiper 810g gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
Organizations using UTT HiPER 810G routers are at immediate risk of complete system compromise due to a publicly exploited buffer overflow vulnerability with no available patch. Attackers with network access can gain full control of affected devices, potentially compromising network security, data integrity, and service availability across dependent systems.
Implement network access controls restricting administrative connections to affected routers; deploy WAF rules blocking POST requests to /goform/formApLbConfig with suspicious loadBalanceNameOld parameters; disable load balancing features if operationally feasible; enforce strict authentication and monitor for exploitation attempts; consider temporary replacement with patched networking equipment; implement network segmentation to limit lateral movement if a device is compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB