EUVD-2026-35067
GHSA-62vp-x748-29pj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed HiPER 2610G admin UI
-
DeliveryObtain low-privilege credentials
-
ExploitAuthenticate to web interface
-
InstallPOST oversized GroupName to formConfigDnsFilterGlobal
-
C2Overflow stack buffer via strcpy
-
ExecuteHijack control flow on router
-
ImpactExecute code or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the router's web management interface (typically TCP 80/443 on the LAN, or WAN if remote management is enabled) and valid low-privilege credentials to that interface (CVSS PR:L). The attacker must be able to invoke the /goform/formConfigDnsFilterGlobal handler and supply a GroupName argument long enough to overflow the stack buffer used by strcpy; no user interaction or additional attack requirements are needed (UI:N, AT:N). Exploitation is limited to UTT HiPER 2610G firmware at or before 3.0.0-171107, and the impact is bounded to the device itself (SC:N/SI:N/SA:N). |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H and E:P (Proof-of-Concept) scores 7.4 High: low-complexity remote attack requiring low privileges (an authenticated session on the management UI) and no user interaction, with high impact on the device. A public PoC is hosted on GitHub (HungryGoogle/log_attack) and the vulnerability is indexed by VulDB, which raises near-term opportunistic risk, but the CVE is not in CISA KEV and no EPSS score was supplied in the input - confidence on widespread exploitation is therefore limited. The PR:L requirement is a meaningful brake: exploitation requires valid admin/operator credentials to the router's web UI, so the realistic threat is highest where default credentials, weak passwords, or Internet-exposed management interfaces are present. Scope and subsequent-system impacts are all None (SC:N/SI:N/SA:N), indicating the blast radius is the device itself rather than lateral compromise - though a compromised perimeter router is still a strong foothold. |
| Exploit ScenarioDerived | An attacker who has obtained low-privilege web UI credentials - for example via phishing, credential reuse, or an exposed default password on an Internet-facing HiPER 2610G - logs in and sends a crafted POST to /goform/formConfigDnsFilterGlobal with an overlong GroupName value. The oversized string overflows the stack buffer inside strcpy, overwriting control data and, using the publicly available PoC from github.com/HungryGoogle/log_attack as a starting point, yields either a crash of the management service or arbitrary code execution on the router. From there the attacker can pivot to intercept LAN traffic, alter DNS settings, or establish persistence on the perimeter device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 08, 2026
Stack buffer overflow in UTT HiPER 2610G routers (firmware through 3.0.0-171107) allows authenticated remote attackers to corrupt memory by submitting an oversized GroupName parameter to the /goform/formConfigDnsFilterGlobal endpoint, which passes the input to an unsafe strcpy call. Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), and successful exploitation can compromise confidentiality, integrity, and availability of the device - typically meaning router takeover or denial of service. The issue is not listed in CISA KEV, so it is not confirmed actively exploited at this time.
Earlier versions of this analysis (2)
Remote stack buffer overflow in UTT HiPER 2610G routers (firmware through 3.0.0-171107) allows authenticated remote attackers to corrupt memory by sending a crafted GroupName argument to the /goform/formConfigDnsFilterGlobal endpoint, which calls strcpy without bounds checking. Publicly available exploit code exists per VulDB disclosure, raising the practical risk for exposed management interfaces despite the relatively narrow authenticated attack surface.
Remote authenticated buffer overflow in UTT HiPER 2610G router firmware up to version 3.0.0-171107 allows attackers to corrupt memory via the GroupName parameter in the /goform/formConfigDnsFilterGlobal endpoint. The flaw stems from an unsafe strcpy call and publicly available exploit code exists, raising the likelihood of opportunistic abuse against exposed management interfaces.
RemediationAI
No vendor-released patch identified at time of analysis - the references contain only VulDB tracking entries and a GitHub PoC, with no UTT firmware update linked. Until UTT publishes fixed firmware, restrict reachability of the management interface: block the router's HTTP/HTTPS admin ports from the WAN entirely and limit LAN-side access to a dedicated management VLAN or jump host, which removes the remote attack surface at the cost of requiring on-network access for administration. Enforce strong, unique admin credentials and disable any default accounts to make the PR:L precondition harder to satisfy, and specifically avoid using the DNS filter group configuration page (/goform/formConfigDnsFilterGlobal) from untrusted networks. Monitor the VulDB entry at https://vuldb.com/vuln/369137 and UTT's site for a firmware release, and apply it as soon as it is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UTT HiPER 2610G is an enterprise/SMB gateway router from UTT Technologies that exposes a web-based management interface using /goform/* CGI-style handlers. The vulnerable handler formConfigDnsFilterGlobal manages DNS filter group configuration and copies the user-supplied GroupName argument into a fixed-size stack buffer using strcpy without length validation, a textbook CWE-120 (Classic Buffer Overflow) condition. On embedded MIPS/ARM routers of this class, such overflows on the request-handling thread typically allow attacker control of the saved return address or function pointers, leading to arbitrary code execution as the web server process (often root) or, at minimum, a crash of the management daemon. The CPE cpe:2.3:a:utt:hiper_2610g identifies the affected firmware family up to and including build 3.0.0-171107.
Know when Hiper 2610G gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strcpy of the file /goform/formConfigDnsFilterGlobal. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Executive ViewAI
UTT HiPER 2610G routers (firmware through version 3.0.0-171107) contain a stack buffer overflow vulnerability enabling authenticated attackers to remotely compromise network infrastructure. Public exploit code exists, increasing the risk of router takeover or denial of service for organizations relying on these devices for network connectivity.
No vendor-released patch identified at time of analysis. Implement: (1) Restrict administrative access to affected routers from authorized network segments only; (2) Disable remote administration features if operationally feasible; (3) Monitor for suspicious configuration changes to DNS filter settings; (4) Deploy intrusion detection signatures for malformed requests to the /goform/formConfigDnsFilterGlobal endpoint; (5) Maintain validated configuration backups for rapid recovery if compromise is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB