Hiper 1250Gw EUVD-2026-19079

Authenticated attacker with login access to UTT HiPER 1250GW running firmware version 3.2.7-210907-180535 or earlier. Attacker must access the /goform/formNatStaticMap endpoint and manipulate the NatBind parameter to trigger buffer overflow in strcpy function.

Real-world risk is moderate-to-high despite the 8.8 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-based exploitation with low attack complexity, but critically requires low-privilege authentication (PR:L), meaning attackers need valid credentials to access the router's web interface before exploitation. This significantly reduces the attack surface compared to unauthenticated vulnerabilities, as default credential usage or prior credential compromise becomes a prerequisite. The publicly available exploit code (GitHub POC) eliminates technical barriers for exploitation, making this a viable target for opportunistic attackers who have gained initial access through credential stuffing, phishing, or brute-force attacks against exposed management interfaces. No EPSS score is provided in the data, and no CISA KEV listing indicates no confirmed active exploitation at time of analysis. However, the combination of public POC availability and high impact (complete device compromise possible) means organizations with internet-exposed management interfaces or untrusted internal users face tangible risk. The attack is not automatable at scale without credential acquisition, reducing worm/botnet potential but not targeted attack risk. Technical impact is critical-successful exploitation grants attackers complete control over network routing, NAT configurations, and potential pivot points into protected networks.

An attacker conducts reconnaissance against an organization's internet-facing infrastructure and identifies a UTT HiPER 1250GW router with exposed web management interface (commonly TCP 80/443). Using credential stuffing attacks with leaked credentials from third-party breaches or default/weak passwords, the attacker authenticates to the router's administrative console with low-privilege user credentials. Navigating to the NAT configuration interface (/goform/formNatStaticMap), the attacker crafts a malicious HTTP request containing an oversized NatBind parameter value-based on the publicly available GitHub POC exploit-triggering the strcpy buffer overflow. The carefully crafted payload overwrites stack memory with shellcode that executes with the router's operating system privileges, granting the attacker a reverse shell with root/administrative access. From this position, the attacker reconfigures NAT rules to redirect internal traffic, establishes persistent backdoor access, exfiltrates routing tables and VPN configurations, and uses the compromised router as a pivot point to launch attacks against internal network resources that trust traffic from the gateway device.