Which versions of Hiper 1200Gw are affected by CVE-2026-4487?

UTT HiPER 1200GW routers are vulnerable to remote exploitation that could allow attackers to gain complete control of affected devices.

Is there a public PoC exploit available for CVE-2026-4487?

Yes, a public proof-of-concept exploit is available for CVE-2026-4487. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4487?

Within 24 hours: Identify and inventory all UTT HiPER 1200GW routers in your environment, particularly those running firmware versions up to 2.5.3-170306, and isolate affected devices from critical network segments if operationally feasible. Within 7 days: Implement network-based controls to restrict access to the /goform/websHostFilter endpoint, disable the vulnerable feature if not essential, and enforce strict access controls limiting administration to trusted networks only. Within 30 days: Contact UTT for patch availability and timeline; prepare a firmware upgrade plan; consider replacing affected devices with alternatives if patches remain unavailable and devices handle sensitive traffic.

Hiper 1200Gw CVE-2026-4487

Q: What is the CVSS score of CVE-2026-4487?

CVE-2026-4487 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13710 HIGH

Classic Buffer Overflow (CWE-120)

2026-03-20 VulDB

Buffer Overflow Hiper 1200Gw

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

CVSS changed

Apr 22, 2026 - 21:37 NVD

8.8 (HIGH) 7.4 (HIGH)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 15:00 euvd

EUVD-2026-13710

Analysis Generated

Mar 20, 2026 - 15:00 vuln.today

CVE Published

Mar 20, 2026 - 14:32 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Unauthenticated attackers can trigger a buffer overflow in UTT HiPER 1200GW firmware versions up to 2.5.3-170306 via the /goform/websHostFilter endpoint, enabling remote code execution with full system compromise. Public exploit code is available and there is currently no patch, leaving affected devices at immediate risk. The vulnerability requires only network access and valid credentials to exploit, making it readily actionable for threat actors.

Technical ContextAI

This vulnerability affects the UTT HiPER 1200GW router (cpe:2.3:a:utt:hiper_1200gw), specifically firmware versions through 2.5.3-170306 dated March 6, 2017. The root cause is CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow), where the strcpy function in the websHostFilter form handler fails to validate input length before copying data into a fixed-size buffer. The strcpy function is a legacy C string manipulation routine known for lacking bounds checking, making it inherently dangerous when handling user-controlled input. This occurs in the web administration interface's host filtering functionality, which is accessible over the network to authenticated users.

RemediationAI

Contact UTT Technologies to inquire about firmware updates newer than version 2.5.3-170306, as the CVSS temporal vector indicates no confirmed remediation level (RL:X), suggesting a patch may not be officially available. Given the age of the affected firmware (2017) and potential end-of-life status, organizations should consider replacing UTT HiPER 1200GW devices with currently-supported alternatives from reputable vendors. As immediate mitigations, restrict administrative interface access to trusted management networks only, implement strong authentication controls, disable remote administration if not required, and deploy intrusion detection systems to monitor for exploitation attempts targeting the /goform/websHostFilter endpoint. Network segmentation should isolate these devices from critical assets until replacement or patching is completed.