Which versions of UTT HiPER 1250GW are affected by EUVD-2026-26295?

The UTT HiPER 1250GW enterprise router contains a high-severity buffer overflow vulnerability (CVE-2026-7418, CVSS 7.4) in firmware up to version 3.2.7-210907-180535 that allows authenticated…

Is there a public PoC exploit available for EUVD-2026-26295?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26295. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-26295?

Within 24 hours, identify all deployed UTT HiPER 1250GW routers and document firmware versions; immediately restrict management interface access to specific trusted administrator IP addresses through firewall rules and disable remote management where operationally feasible. Within 7 days, deploy IDS/IPS detection signatures for CVE-2026-7418 exploitation attempts, implement network segmentation to isolate affected routers on a restricted management VLAN, and rotate credentials for all management accounts. Within 30 days, monitor vendor security bulletins for patch availability, conduct penetration testing to validate access controls, and prepare detailed upgrade or replacement timeline should UTT release firmware fixes.

UTT HiPER 1250GW EUVD-2026-26295

Q: What is the CVSS score of EUVD-2026-26295?

EUVD-2026-26295 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7418 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-29 VulDB

Buffer Overflow Hiper 1250Gw Utt

7.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remotely reachable web endpoint (AV:N/AC:L) requiring an authenticated low-privilege admin session (PR:L), no user interaction, with buffer overflow enabling code execution and full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 01:23 vuln.today

PoC Detected

Apr 30, 2026 - 14:52 vuln.today

Public exploit code

CVSS changed

Apr 29, 2026 - 22:22 NVD

8.8 (HIGH) 7.4 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 22:15 euvd

EUVD-2026-26295

CVE Published

Apr 29, 2026 - 22:00 nvd

HIGH 7.4

DescriptionCVE.org

A vulnerability was determined in UTT HiPER 1250GW up to 3.2.7-210907-180535. This vulnerability affects the function strcpy of the file route/goform/NTP. Executing a manipulation of the argument Profile can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Stack buffer overflow in the UTT HiPER 1250GW enterprise router (firmware up to 3.2.7-210907-180535) allows an authenticated attacker to corrupt memory by supplying an oversized Profile parameter to the route/goform/NTP web handler, which passes it to an unbounded strcpy(). The flaw is remotely reachable over the management interface and publicly available exploit code exists, though it is not listed in CISA KEV and carries a very low EPSS score (0.04%). Successful exploitation yields total compromise of confidentiality, integrity, and availability on the device.

Technical ContextAI

The HiPER 1250GW is a gateway/router appliance whose web administration interface exposes 'goform' CGI-style endpoints. The vulnerable code path is the NTP configuration handler (route/goform/NTP), which copies the user-supplied 'Profile' argument into a fixed-size stack buffer using strcpy() without validating the input length. This maps directly to CWE-120 (Buffer Copy without Checking Size of Input, the 'Classic Buffer Overflow'): because strcpy() copies until a null terminator, an attacker-controlled string longer than the destination buffer overwrites adjacent stack memory, including saved registers and the return address. On embedded MIPS/ARM router firmware like this, such overflows commonly lead to control-flow hijack and arbitrary code execution in the context of the web server process, typically running with high privilege. The single affected CPE is cpe:2.3:a:utt:hiper_1250gw.

RemediationAI

No vendor-released patch or fixed firmware version was identified in the available data, so no exact upgrade target can be cited. As specific compensating controls: restrict access to the router's web management interface to trusted management networks or a dedicated VLAN so the route/goform/NTP endpoint is not reachable from user or WAN-facing segments (trade-off: administrators must connect from an approved jump host); disable remote/WAN-side administration if enabled; enforce strong, unique administrative credentials and rotate any defaults, since exploitation requires an authenticated session (PR:L); and monitor the management interface for anomalous or oversized POST requests to the NTP handler. Consult the VulDB advisory at https://vuldb.com/vuln/360155 for updates, and contact UTT for firmware guidance. Because this is embedded firmware, consider replacing the device if the vendor provides no fix and management access cannot be adequately isolated.