Which versions of UTT HiPER 1250GW are affected by CVE-2026-7420?

The UTT HiPER 1250GW router (firmware ≤3.2.7) contains a remote code execution vulnerability in the web administration interface requiring authenticated access.

Is there a public PoC exploit available for CVE-2026-7420?

Yes, a public proof-of-concept exploit is available for CVE-2026-7420. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7420?

Within 24 hours, inventory all UTT HiPER 1250GW deployments running firmware 3.2.7-210907-180535 or earlier, and implement temporary access restrictions to the web administration interface by limiting login to trusted IP addresses and disabling remote administration where feasible. Within 7 days, establish persistent network monitoring for exploitation attempts against the ConfigAdvideo handler and apply network segmentation to isolate affected routers from sensitive segments. Within 30 days, monitor UTT's security advisories for patched firmware and deploy it immediately upon release; until then, operate affected routers with minimal administrative access and continuous detection monitoring.

UTT HiPER 1250GW CVE-2026-7420

Q: What is the CVSS score of CVE-2026-7420?

CVE-2026-7420 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Classic Buffer Overflow (CWE-120)

2026-04-29 VulDB

Buffer Overflow Hiper 1250Gw Utt

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable web handler with low-complexity strcpy overflow; PR:L reflects required low-privilege auth to the admin interface, and total impact yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:20 vuln.today

PoC Detected

Apr 30, 2026 - 14:52 vuln.today

Public exploit code

CVSS changed

Apr 29, 2026 - 23:22 NVD

8.8 (HIGH) 7.4 (HIGH)

CVE Published

Apr 29, 2026 - 22:30 nvd

HIGH 7.4

DescriptionCVE.org

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file route/goform/ConfigAdvideo. The manipulation of the argument Profile results in buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

Remote code execution risk in the UTT HiPER 1250GW router (firmware up to 3.2.7-210907-180535) stems from an unbounded strcpy in the ConfigAdvideo web handler, where an oversized 'Profile' parameter overflows a stack buffer. Authenticated remote attackers (CVSS 4.0 PR:L) can crash the device or potentially hijack execution flow, achieving total impact on confidentiality, integrity, and availability. Publicly available exploit code exists per VulDB, though EPSS remains very low (0.04%) and there is no public exploit identified as actively used in the wild.

Technical ContextAI

The HiPER 1250GW is a small-business gateway/router produced by Chinese vendor UTT (cpe:2.3:a:utt:hiper_1250gw). The vulnerability lives in the device's HTTP administration interface, specifically the route/goform/ConfigAdvideo endpoint that processes advertising/video configuration profiles. The root cause is CWE-120 (Classic Buffer Overflow / copy without checking input size): the handler passes the attacker-controlled 'Profile' argument directly to strcpy() into a fixed-size buffer with no length validation, a pattern endemic to embedded MIPS/ARM router firmware built on lightweight goform-style web servers. Overflowing this stack buffer corrupts adjacent memory and saved registers, enabling denial of service and, on many such SDKs, control-flow hijack.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed firmware version is cited in the available data, so contact UTT directly and monitor for a firmware release superseding 3.2.7-210907-180535. As compensating controls, restrict access to the web administration interface - do not expose the router's HTTP management port to the internet, and bind management to a trusted management VLAN or ACL-limited source addresses (trade-off: remote admin becomes inaccessible without VPN). Since exploitation requires low-privilege authentication, enforce strong, unique admin/user credentials and disable unused low-privilege accounts to raise the bar (trade-off: operational overhead). Where feasible, place the ConfigAdvideo/goform endpoints behind a reverse proxy or WAF rule that rejects oversized 'Profile' values (trade-off: may break legitimate long profile names). Reference the VulDB advisory at https://vuldb.com/vuln/360157 for tracking.