Hiper 1200Gw CVE-2026-4487

Requires authenticated login (PR:L) to UTT HiPER 1200GW running firmware versions up to 2.5.3-170306. Attacker with low-privilege credentials can remotely exploit the buffer overflow vulnerability in the /goform/websHostFilter function via strcpy. No user interaction needed.

The CVSS v3.1 score of 8.8 (High) reflects significant impact with network-based attack vector (AV:N), low complexity (AC:L), and requiring only low privileges (PR:L) with no user interaction (UI:N). While authentication is required, the availability of a public exploit on GitHub (https://github.com/hmKunlun/UTTHiPER/blob/main/HiPER%201200GW.md) dramatically increases real-world risk by enabling script-kiddie level attacks. The CVSS temporal metrics show proof-of-concept code exists (E:P) with remediation level unproven (RL:X), indicating no official patch may be available. For edge network devices like routers, buffer overflows leading to remote code execution represent critical infrastructure risks, as they can provide persistent access to internal networks. Organizations using this equipment should treat this as a high-priority remediation item, especially given the public exploit and the device's role as a network perimeter component.

An attacker who has obtained or brute-forced low-privilege credentials to the router's web interface (possibly through credential stuffing or default passwords) sends a crafted HTTP request to the /goform/websHostFilter endpoint with an oversized input parameter. The strcpy function copies this malicious payload into a fixed-size stack buffer without bounds checking, overwriting adjacent memory including the return address. The attacker leverages the publicly available proof-of-concept code from GitHub to execute arbitrary code with the privileges of the web server process, gaining complete control of the router to intercept traffic, pivot into the internal network, or establish persistent backdoor access.