Which versions of Hiper 1200Gw are affected by CVE-2026-6186?

CVE-2026-6186 is a high-severity remote code execution vulnerability affecting UTT HiPER 1200GW routers through version 2.5.3-170306, exploitable by authenticated users with publicly available…

Is there a public PoC exploit available for CVE-2026-6186?

Yes, a public proof-of-concept exploit is available for CVE-2026-6186. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6186?

Within 24 hours: Inventory all UTT HiPER 1200GW routers in production and disable internet-facing access via firewall or network segmentation; audit admin credentials and recent access logs. Within 7 days: Contact UTT for patch availability timeline and interim firmware updates; evaluate replacement timelines if routers are end-of-life. Within 30 days: Replace affected devices with patched versions or alternative vendor equipment; implement network access controls restricting administrative access to trusted IP ranges only.

Hiper 1200Gw CVE-2026-6186

Q: What is the CVSS score of CVE-2026-6186?

CVE-2026-6186 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-21984 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-13 VulDB

Buffer Overflow Hiper 1200Gw

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

PoC Detected

Apr 22, 2026 - 20:23 vuln.today

Public exploit code

CVSS changed

Apr 13, 2026 - 16:22 NVD

8.8 (HIGH) 7.4 (HIGH)

Analysis Generated

Apr 13, 2026 - 16:09 vuln.today

EUVD ID Assigned

Apr 13, 2026 - 15:45 euvd

EUVD-2026-21984

Analysis Generated

Apr 13, 2026 - 15:45 vuln.today

CVE Published

Apr 13, 2026 - 15:15 nvd

HIGH 7.4

DescriptionCVE.org

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This vulnerability affects the function strcpy of the file /goform/formNatStaticMap. The manipulation of the argument NatBind leads to buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

AnalysisAI

Buffer overflow in UTT HiPER 1200GW router versions up to 2.5.3-170306 enables remote authenticated attackers to execute arbitrary code with high privileges via malformed NatBind parameters to the /goform/formNatStaticMap endpoint. Publicly available exploit code exists (GitHub POC published), significantly lowering exploitation barrier. EPSS data not available, but combination of network attack vector, low complexity (CVSS AC:L), and public POC indicates elevated real-world exploitation risk for internet-facing devices with weak credential protection.

Technical ContextAI

This vulnerability resides in the NAT static mapping configuration interface of UTT HiPER 1200GW enterprise router firmware. The affected strcpy function in /goform/formNatStaticMap fails to validate the length of user-supplied NatBind parameter before copying to a fixed-size stack buffer, creating a classic CWE-120 stack-based buffer overflow. The strcpy C function performs no bounds checking and continues copying until a null terminator is encountered, allowing attackers to overwrite adjacent memory including return addresses and function pointers. The /goform/ path typically handles web-based management interface requests in embedded router firmware, suggesting this is part of the administrative CGI handler. CPE identifier cpe:2.3:a:utt:hiper_1200gw confirms UTT (Shanghai UTT Technologies) HiPER 1200GW as the affected product line. This class of vulnerability is particularly dangerous in SOHO/SMB network devices due to long device lifecycles and inconsistent patching practices.

RemediationAI

No vendor-released patch identified at time of analysis based on available intelligence sources. Organizations deploying UTT HiPER 1200GW devices should immediately implement the following mitigation controls: disable remote management interface access from untrusted networks (WAN), restrict administrative access to specific trusted IP ranges via firewall rules, enforce strong unique credentials replacing any default passwords, enable administrative access logging and monitoring for suspicious NAT configuration attempts targeting /goform/formNatStaticMap endpoint. Consider network segmentation to isolate vulnerable devices from untrusted network zones. Monitor UTT Technologies official channels and VulDB entry vuldb.com/vuln/357108 for patch availability announcements. If devices must remain internet-accessible, deploy web application firewall or reverse proxy with input validation to filter malformed NatBind parameters exceeding expected length constraints. Long-term remediation requires vendor firmware update addressing the unsafe strcpy usage; organizations should engage UTT support channels to request patched firmware and establish vulnerability disclosure timeline.