UTT HiPER 1250GW CVE-2026-7418

Exploitation requires network reachability to the router's web administration interface and an authenticated session with at least low privileges (CVSS PR:L), from which the attacker submits a request to the route/goform/NTP handler with an oversized 'Profile' argument that overflows a fixed stack buffer via strcpy(). The exploitation is limited by: (1) the authentication requirement - a valid low-privilege admin login is needed; (2) exposure of the management interface - if administration is restricted to an internal/management network, remote attackers cannot reach the endpoint; and (3) the narrow affected scope, limited to UTT HiPER 1250GW firmware ≤ 3.2.7-210907-180535. No user interaction is required once access to the endpoint is obtained.

The signals are mixed and point to a genuine-but-narrow risk. The CVSS 4.0 base score of 7.4 (High) reflects network attack vector, low complexity, no user interaction, and total technical impact (VC:H/VI:H/VA:H), but requires PR:L - meaning the attacker must already hold at least low-privileged authenticated access to the device. SSVC corroborates this: Exploitation=poc (not active), Automatable=no, Technical Impact=total. The EPSS probability is only 0.04% (12th percentile), and the CVE is NOT in CISA KEV, so despite public POC code there is no evidence of widespread or active exploitation. The dominant limiting factors are the authentication requirement and the niche deployment footprint of this specific UTT appliance. In short: high impact if reached, but real-world priority is moderate-to-low for most organizations unless they operate this exact router with exposed/weakly-protected management access. No conflicting data was identified between the vector and description - both agree exploitation is remote and requires some access to the admin interface.

An attacker who has obtained low-privileged administrative access to the HiPER 1250GW web console (via weak/default credentials, credential reuse, or an exposed management interface) sends a crafted request to route/goform/NTP with an over-long Profile parameter. The oversized string overflows the stack buffer in the strcpy() call, overwriting the return address and redirecting execution to attacker-supplied shellcode, granting full control of the router. Public exploit code for this flaw is available on GitHub (kirlic123/IOTvulner), lowering the barrier to weaponization.