Hiper 1250Gw EUVD-2026-13727

Authenticated user access required to UTT HiPER 1250GW firmware versions up to 3.2.7-210907-180535. Attacker must send crafted request to /goform/setSysAdm endpoint with oversized GroupName parameter to trigger buffer overflow via strcpy().

This vulnerability presents significant real-world risk despite requiring low-privilege authentication (PR:L). The CVSS base score of 8.8 reflects high impact across all three security properties (C:H/I:H/A:H) with network accessibility (AV:N) and low attack complexity (AC:L). The existence of a public exploit (E:P) on GitHub dramatically increases the exploitation likelihood, as attackers can readily weaponize the proof-of-concept code. The attack requires only authenticated access to the web interface, which in many deployments uses default or weak credentials. The combination of network-accessible attack vector, publicly available exploit code, and the criticality of gateway devices in network infrastructure makes this a genuine priority for remediation. Organizations using UTT HiPER 1250GW devices should treat this as high-priority, especially if these devices are exposed to untrusted users or networks. The reliability rating (RC:R) indicates the technical details are well-understood and reproducible.

An attacker who has obtained low-privilege credentials to the router's web interface (through credential stuffing, default passwords, or social engineering) authenticates to the device over the network. The attacker then sends a specially crafted HTTP request to the /goform/setSysAdm endpoint with an oversized GroupName parameter exceeding the buffer size, following the publicly available proof-of-concept on GitHub. The strcpy function copies this malicious input without bounds checking, overwriting the stack and hijacking program execution to attacker-controlled shellcode, granting complete control over the router and potentially enabling lateral movement into the protected network.