Hiper 1200Gw EUVD-2026-21984

Requires authenticated access to UTT HiPER 1200GW firmware versions up to 2.5.3-170306. Attacker must have login credentials to access the /goform/formNatStaticMap endpoint and manipulate the NatBind parameter to trigger buffer overflow via strcpy function.

Real-world risk is HIGH despite requiring low-privilege authentication (CVSS PR:L). The CVSS v3.1 base score of 8.8 accurately reflects severity: network attack vector (AV:N) enables remote exploitation, low attack complexity (AC:L) means no special conditions required, and complete impact triad (C:H/I:H/A:H) allows full device compromise. The exploit maturity indicator (E:P for Proof-of-Concept) combined with confirmed publicly available exploit code on GitHub substantially increases exploitation probability. Authentication requirement provides minimal protection as many UTT devices use default credentials or weak passwords in deployment. No EPSS score available, but historical data shows router vulnerabilities with public POCs typically see exploitation within 30-90 days. CISA KEV status not confirmed, suggesting no confirmed active exploitation campaigns yet, but the public POC significantly lowers this threshold. SSVC framework assessment: Exploitation=POC, Automatable=Yes (standard HTTP request), Technical Impact=Total (full system control). This combination yields a 'scheduled' or 'out-of-cycle' patching priority. Primary risk: devices exposed to internet management interfaces or compromised internal networks where attackers have obtained low-privilege credentials.

An external attacker scans internet IP ranges identifying UTT HiPER 1200GW devices via fingerprinting of the web management interface on common ports (80/443/8080). After identifying a target device, the attacker attempts authentication using credential stuffing with common default passwords (admin/admin, admin/password) or previously compromised credentials from corporate breaches. Upon successful authentication with low-privilege user account, the attacker crafts a malicious HTTP POST request to /goform/formNatStaticMap containing a NatBind parameter with 500+ byte payload designed to overflow the strcpy destination buffer and overwrite the stack return address. The payload includes shellcode to establish reverse shell connection back to attacker infrastructure, executing with the privilege level of the web server process (typically root on embedded devices). The attacker gains persistent remote access to the router, enabling network traffic interception, internal network pivoting, firmware implant installation, or DDoS botnet recruitment.