EUVD-2026-33821
GHSA-wrr2-9hf7-vjc4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed HiPER 1200GW web UI
-
DeliveryObtain low-privilege credentials
-
ExploitSend crafted POST to /goform/formTaskEdit
-
InstallOverflow stack via strcpy
-
C2Hijack return address
-
ExecuteExecute shellcode on router
-
ImpactPivot into internal network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the UTT HiPER 1200GW HTTP management interface and valid low-privilege authenticated access to the device's web admin panel (CVSS PR:L), specifically the ability to invoke the /goform/formTaskEdit endpoint. Limiting factors are: the management interface must be exposed to the attacker's network position (LAN by default, WAN only if remote administration was enabled), the device must be running firmware version 2.5.3-170306 or earlier, and the attacker must already possess at least a low-privileged account. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once authenticated access is obtained, exploitation is straightforward using the published PoC. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4 (High), reflecting network-reachable, low-complexity attack with no user interaction but requiring low privileges (PR:L), meaning at least basic authenticated access to the management interface is needed. The E:P (Proof-of-Concept) threat metric aligns with the disclosed fact that publicly available exploit code exists on GitHub, materially raising real-world risk. No EPSS score or CISA KEV listing is included in the provided intelligence, so widespread mass exploitation is not confirmed; however, SOHO router admin credentials are frequently default or weak, which can effectively erode the PR:L barrier. Overall this is a credible priority for any organization exposing the device's web UI to untrusted networks, but lower priority than an unauthenticated zero-click bug. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege credentials to the UTT HiPER 1200GW web interface (e.g., via credential reuse, phishing, or default passwords) sends a crafted HTTP POST request to /goform/formTaskEdit containing an over-length parameter that is processed by the vulnerable strcpy call. The overflow overwrites saved return data on the stack, enabling either a denial of service of the router or execution of attacker-controlled shellcode on the embedded device, granting persistent control of the network gateway. A public proof-of-concept on GitHub demonstrates the trigger, lowering the skill required to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 01, 2026
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware versions up to 2.5.3-170306) allows remote authenticated attackers to corrupt memory via the strcpy function in the /goform/formTaskEdit endpoint. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges. No KEV listing or EPSS data is provided in the input, so widespread automated exploitation has not been confirmed.
Earlier versions of this analysis (2)
Stack-based buffer overflow in UTT HiPER 1200GW router firmware up to version 2.5.3-170306 allows authenticated remote attackers to corrupt memory through the strcpy function in the /goform/formTaskEdit endpoint. Publicly available exploit code exists, raising the operational risk for exposed devices, though there is no public exploit identified as actively exploited in the wild via CISA KEV at time of analysis. Successful exploitation can yield high impact on confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory via the strcpy function in the /goform/formTaskEdit endpoint. Publicly available exploit code exists per VulDB submission 367585, raising the practical risk despite no confirmation of active exploitation in CISA KEV. The high CVSS 8.8 reflects network-reachable impact on confidentiality, integrity, and availability with only low-privilege authentication required.
RemediationAI
No vendor-released patch identified at time of analysis - UTT has not published a fixed firmware version in the available references. As compensating controls, restrict access to the router's web management interface to a trusted management VLAN or admin workstation by binding the HTTP/HTTPS admin service to LAN-only and explicitly disabling WAN-side administration (side effect: remote admin convenience is lost). Replace default and weak administrator credentials with strong unique passwords to raise the bar against the PR:L requirement, and place the device behind an upstream firewall blocking inbound TCP 80/443/8080 to the device from the internet. Monitor https://vuldb.com/vuln/367585 for vendor firmware updates and consider device replacement if UTT does not issue a fix, since end-of-life SOHO routers commonly remain unpatched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product (cpe:2.3:a:utt:hiper_1200gw) is a small-business/SOHO gateway router manufactured by UTT Technologies. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), rooted in the use of the unsafe strcpy() C library function inside the formTaskEdit handler of the device's web management interface (/goform/ path is typical of embedded Boa/GoAhead-style web servers). Because strcpy() performs no bounds checking on the destination buffer, attacker-supplied input copied from an HTTP form field overruns the fixed-size stack buffer, overwriting saved return addresses and potentially enabling control-flow hijack on the MIPS/ARM firmware typical of these devices.
Know when Hiper 1200Gw gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in UTT HiPER 1200GW up to 2.5.3-170306. This affects the function strcpy of the file /goform/formTaskEdit. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.
Executive ViewAI
UTT HiPER 1200GW routers (firmware ≤2.5.3-170306) contain a remote buffer overflow vulnerability that allows authenticated attackers to corrupt memory and potentially seize control of critical network infrastructure. Organizations using these devices face operational risk due to publicly available exploit code and the absence of vendor patches.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict administrative access to the router's management interface via firewall rules, permitting connections only from trusted administrative networks; (2) Disable remote management and require local console access only where operationally possible; (3) Segment affected routers via separate VLANs to contain potential lateral movement; (4) Enable and monitor router logs for repeated failed authentication attempts and malformed requests to /goform/formTaskEdit; (5) Enforce strong authentication credentials with multi-factor authentication where supported; (6) Evaluate device replacement options from alternative vendors with current security support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Hiper 1200Gw
View allStack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via
Stack-based buffer overflow in UTT HiPER 1200GW firmware up to v2.5.3-170306 enables network-reachable authenticated att
Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote atta
Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated
Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows authenticated remote attack
Buffer overflow in UTT HiPER 1200GW router versions up to 2.5.3-170306 enables remote authenticated attackers to execute
Unauthenticated attackers can trigger a buffer overflow in UTT HiPER 1200GW firmware versions up to 2.5.3-170306 via the
Exploit-DB