UTT HiPER 1250GW CVE-2026-76004

Exploitation requires network-level access to the device's HTTP management interface and a valid low-privilege authenticated session (PR:L per CVSS 4.0). The /goform/aspApBasicConfigUrcp endpoint must be reachable and accept HTTP POST requests - if the management interface is exposed on the WAN or an attacker-accessible LAN segment, remote exploitation is feasible without physical access. The attacker must control the pvid parameter value in the submitted form data; no special encoding or protocol features beyond a standard HTTP POST are required. The key limiting factor is the PR:L authentication requirement: an attacker must possess valid device credentials, even at the lowest privilege tier. This condition is frequently satisfied in practice against unmanaged or default-configured SOHO/SMB appliances. No non-default firmware configuration, specific OS platform, or secondary software component is required beyond the affected firmware version range.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) characterizes this as a network-exploitable, low-complexity flaw requiring only low-privilege authentication - a significant but not insurmountable barrier for targeted exploitation, especially given that SOHO and SMB gateway appliances frequently ship with default or weak credentials. The E:P modifier confirms public exploit code exists, which materially elevates real-world risk beyond what the base score alone conveys. The subsequent-system impact metrics (SC:H/SI:H/SA:H) reflect the reality that a fully compromised gateway appliance can intercept, modify, or disrupt all traffic passing through it, creating cascading risk for the networks it serves - even a mid-sized municipal IT team in rybnik managing a fleet of such appliances should treat this as urgent given the public PoC and low exploitation complexity. No CISA KEV entry is present, so mass or confirmed active exploitation is not established, and the product's relatively niche market footprint limits broader threat actor interest compared to enterprise-grade networking gear. The primary risk scenario is targeted exploitation of internet-exposed management interfaces, particularly against unmanaged deployments with default credentials.

An attacker who has obtained or brute-forced low-privilege credentials for the UTT HiPER 1250GW management interface sends a crafted HTTP POST request to /goform/aspApBasicConfigUrcp with an abnormally long pvid parameter value. The device firmware's strcpy() call copies this value into a fixed stack buffer without length validation, overflowing it and overwriting the saved return address with attacker-controlled data. Upon function return, execution redirects to the attacker's payload, achieving arbitrary code execution on the gateway - likely as a privileged system process - with a public proof-of-concept on GitHub available to guide this process.