UTT HiPER 1250GW CVE-2026-78169

The CVSS 4.0 vector specifies PR:L, meaning the attacker must hold at least a low-privileged authenticated session on the device's HTTP management interface before triggering the overflow. The specific trigger is a POST request to /goform/aspRemoteApConfTempSend with an oversized value in the Profile parameter - this endpoint appears to handle remote AP (Access Point) configuration templates, suggesting it is accessible to users with wireless management permissions. Exploitation is bounded by: (1) the attacker must possess valid device credentials at any privilege level, or chain this vulnerability with a separate authentication bypass; (2) the device's HTTP management port must be reachable from the attacker's network position. Devices where management is restricted to the LAN or a dedicated out-of-band management network face substantially reduced remote exploitation risk. No special firmware configuration beyond having the HTTP management service active (typically default) is implied by the description.

The CVSS 4.0 score of 8.6 with base metrics AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-reachable, low-complexity attack requiring only low-privileged credentials. The subsequent-system impact of SC:H/SI:H/SA:H is significant - on a network gateway appliance, code execution can expose all traffic passing through the device and connected network segments, making the blast radius substantially larger than the device itself. The E:P threat modifier confirms a publicly available exploit, meaningfully lowering the barrier for opportunistic threat actors. No EPSS score was present in the provided intelligence; no CISA KEV listing exists, indicating no confirmed mass exploitation at analysis time. The PR:L requirement is a real constraint: attackers without credentials face an additional step, though credential stuffing or default-credential attacks on SMB-grade appliances are common. The primary risk is targeted exploitation of internet-exposed management interfaces by actors leveraging the public POC.

An attacker with low-privileged credentials - obtained via default password lists or credential reuse common in SMB environments - authenticates to the UTT HiPER 1250GW HTTP management interface and submits a POST request to /goform/aspRemoteApConfTempSend with an oversized Profile parameter value crafted to overwrite the return address on the stack. Using the publicly available proof-of-concept on GitHub as a template, the attacker achieves arbitrary code execution as the firmware process, enabling persistent backdoor installation, traffic interception, or lateral movement into connected network segments.