810g Firmware EUVD-2026-19255

CVSS score of 4.5 reflects low-to-medium severity, driven by a high attack complexity requirement (authenticated attacker with administrator privileges, AV:A network-adjacent attack vector, and AC:L low complexity). The attack has no confidentiality or integrity impact (C:N, I:N) and only causes availability loss (A:H). Real-world risk is constrained by the requirement for PR:H (high privileges), meaning only trusted administrators or attackers who have already compromised administrative credentials can exploit this. EPSS exploitation probability is not provided in the intelligence data. KEV status is negative (not on CISA catalog), and no public exploit code is documented, suggesting this is a lower-priority issue despite the CVSS score. From an SSVC perspective, exploitation is unconfirmed, the attack is not automatable at scale (requires credentials and network adjacency), and technical impact is limited to denial of service rather than confidentiality or integrity breach.

An authenticated administrator with high-privilege access to a UTT Aggressive HiPER 810G v3 device crafts a malicious configuration request containing an oversized string in the notes parameter of the formGroupConfig function. The oversized input overflows the buffer, corrupting adjacent memory and causing the device to crash or enter an unstable state, resulting in a denial of service. Recovery typically requires manual restart of the affected device.