UTT HiPER 1200GW CVE-2026-76003

Low-privilege authenticated access to the UTT HiPER 1200GW web management interface is required, as indicated by PR:L in the CVSS 4.0 vector. The attacker must be able to reach the device's HTTP management port over the network (AV:N). The vulnerable code path is specifically in the /goform/formGroupConfig endpoint processing the timestart POST parameter - this endpoint must be reachable and the formGroupConfig functionality must be present in the running firmware build (confirmed for versions up to 2.5.3-170306). Exploitation is blocked when the management interface is firewalled to untrusted networks, when strong non-default credentials are enforced preventing low-effort credential acquisition, or when the device firmware version is beyond 2.5.3-170306 (though no confirmed patched version exists). There is no user interaction required beyond the attacker's own actions.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and E:P threat metric confirm low-complexity, network-accessible exploitation by a low-privileged authenticated user with a working PoC. The high impact on subsequent systems (SC:H/SI:H/SA:H) reflects this device's role as a network gateway - compromise yields a pivot point into the downstream network segment. The PR:L requirement is the primary mitigating factor: attackers must first obtain valid credentials, which raises the bar above fully unauthenticated exploitation. However, default or weak credentials are common on SOHO-class devices, effectively reducing this barrier in many real deployments. No CISA KEV listing has been identified, so active exploitation is not confirmed, but the publicly available PoC on GitHub materially increases the realistic threat. No patch or vendor advisory has been identified, meaning the only controls are compensating measures. Risk is elevated for deployments where the management interface is network-accessible and default credentials have not been changed.

An attacker who has obtained low-privilege credentials to the HiPER 1200GW web interface - for example, via default credentials or credential reuse - sends a crafted HTTP POST request to /goform/formGroupConfig with a timestart value significantly exceeding the expected buffer size. The strcpy() call copies the oversized input onto the stack, corrupting the return address of the handler function and redirecting execution to attacker-controlled shellcode or a ROP chain. The public PoC at https://github.com/7wkajk/CVE-VUL/blob/main/105.md demonstrates this technique, lowering the skill threshold for exploitation.