Hiper 1250Gw CVE-2026-4862

Requires authenticated access to UTT HiPER 1250GW running firmware versions up to 3.2.7-210907-180535. Attacker must send crafted input to the /goform/formConfigDnsFilterGlobal endpoint with malicious GroupName parameter to trigger buffer overflow in strcpy function.

The CVSS 3.1 score of 8.8 reflects high severity across all impact metrics (C:H/I:H/A:H), with network-based attack vector (AV:N) and low complexity (AC:L), though exploitation requires low-level authentication (PR:L) and no user interaction (UI:N). The publicly available exploit code exists, as confirmed by the GitHub repository reference, significantly lowering the technical barrier for attackers. The exploit maturity indicator (E:P for Proof-of-concept) confirms functional exploit code is accessible. While not confirmed actively exploited (CISA KEV), the combination of remote exploitability, low attack complexity, authenticated access requirement that is often weak in IoT devices, and public exploit availability makes this a genuine priority for remediation. IoT/router vulnerabilities are frequently targeted at scale once exploitation tools are public. The authentication requirement provides some mitigation but should not be considered a strong barrier given typical weak credential practices in embedded devices.

An attacker with low-privilege authenticated access to the UTT HiPER 1250GW web management interface (potentially obtained through credential stuffing, default passwords, or social engineering) can send a specially crafted HTTP request to the /goform/formConfigDnsFilterGlobal endpoint with an oversized GroupName parameter value. The publicly available exploit code demonstrates how to trigger the strcpy buffer overflow, potentially allowing the attacker to execute arbitrary code with device privileges, leading to complete router compromise, network traffic interception, or pivoting to internal network resources.