Which versions of UTT HiPER 1250GW are affected by CVE-2026-7419?

The UTT HiPER 1250GW network gateway contains a remote buffer overflow affecting firmware versions through 3.2.7; publicly available exploit code exists and the vulnerability could enable…

Is there a public PoC exploit available for CVE-2026-7419?

Yes, a public proof-of-concept exploit is available for CVE-2026-7419. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7419?

Within 24 hours: identify all UTT HiPER 1250GW devices in production, document their firmware versions, and assess which require emergency remediation. Within 7 days: restrict management interface access to a defined administrative network segment (VPN jump host or secured subnet), rotate all administrative credentials to unique strong passwords, and enable maximum audit logging on each device. Within 30 days: establish formal communication with UTT support to obtain a patch timeline and any interim security recommendations; implement continuous device monitoring for crashes or anomalous configuration changes; develop a contingency replacement plan in case no patch is forthcoming within 60 days; consider deploying a parallel gateway for failover capability.

UTT HiPER 1250GW CVE-2026-7419

Q: What is the CVSS score of CVE-2026-7419?

CVE-2026-7419 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Classic Buffer Overflow (CWE-120)

2026-04-29 VulDB

Buffer Overflow Hiper 1250Gw Utt

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Management endpoint requires an authenticated low-privilege session (PR:L) but is network-reachable with no user interaction; unbounded strcpy overflow yields full device compromise, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:22 vuln.today

PoC Detected

Apr 30, 2026 - 14:52 vuln.today

Public exploit code

CVSS changed

Apr 29, 2026 - 23:22 NVD

8.8 (HIGH) 7.4 (HIGH)

CVE Published

Apr 29, 2026 - 22:15 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file route/goform/formTaskEdit_ap. The manipulation of the argument Profile leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

AnalysisAI

Stack buffer overflow in the UTT HiPER 1250GW gateway/router (firmware up to 3.2.7-210907-180535) lets a low-privileged authenticated attacker corrupt memory by supplying an oversized 'Profile' parameter to the formTaskEdit_ap web handler, which copies it via an unbounded strcpy(). The flaw is remotely reachable over the device's management interface and publicly available exploit code exists, though it is not listed in CISA KEV and carries a very low EPSS score (0.04%). Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.

Technical ContextAI

The affected component is the embedded HTTP administration server of the UTT HiPER 1250GW, a Chinese-market enterprise gateway/VPN router. The vulnerable code path is route/goform/formTaskEdit_ap, a goform CGI-style handler used to edit task/AP profile settings. The root cause is CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow): the handler passes the user-supplied 'Profile' argument directly to strcpy(), which copies until a NUL terminator with no bounds check against the destination buffer. On the MIPS/ARM-class SoCs typical of these appliances, overflowing a fixed-size stack buffer can overwrite saved return addresses, enabling denial of service and, depending on stack layout and mitigations (these embedded builds frequently lack stack canaries/ASLR), remote code execution.

RemediationAI

No vendor-released patch identified at time of analysis, and no fixed firmware version is cited in the source data - monitor UTT for a firmware release superseding 3.2.7-210907-180535 and apply it once published. As compensating controls, restrict access to the device's web management interface: bind administration to a trusted management VLAN or LAN interface only and disable remote/WAN-side management so the formTaskEdit_ap endpoint is not reachable from untrusted networks (trade-off: administrators must be on the management network or use a VPN). Enforce strong, unique administrative credentials and limit the number of accounts, since exploitation requires an authenticated low-privilege session (PR:L); tightening account access directly raises the bar. Place the management interface behind an ACL/firewall permitting only specific admin source IPs. Refer to the VulDB advisory at https://vuldb.com/vuln/360156 for tracking; the public exploit write-up is at https://github.com/kirlic123/IOTvulner/blob/main/4035/2/2.md.