UTT HiPER 1250GW EUVD-2026-53019

Exploitation requires network-level reachability of the UTT HiPER 1250GW management web interface and a valid low-privilege authenticated session (PR:L per CVSS 4.0 vector). The specific vulnerable code path is triggered only when a POST request is submitted to the /goform/APSecurity_5g endpoint with an oversized value in the cipher parameter. Exploitation is not possible without satisfying the authentication requirement - however, on devices with factory-default credentials, this condition is trivially met. Key limiting factors: the management interface must be reachable on the network (default on LAN; WAN exposure depends on device configuration); valid credentials must be obtained, guessed, or derived from device defaults; and the vulnerable endpoint must not be filtered by access-control rules. No user interaction is required beyond the attacker's own authenticated request. Embedded firmware typically lacks stack canaries and ASLR, removing common exploitation barriers present on hardened platforms.

The CVSS 4.0 base score of 7.4 reflects network-accessible exploitation (AV:N) with low complexity (AC:L), no additional attack requirements (AT:N), low privilege (PR:L), no user interaction (UI:N), and full impact on the vulnerable system's confidentiality, integrity, and availability (VC:H/VI:H/VA:H), with no lateral impact on subsequent systems (SC:N/SI:N/SA:N). The supplemental E:P metric confirms exploit code is publicly available. No CISA KEV listing is present, so active in-the-wild exploitation is not confirmed. However, the convergence of a public PoC, a silent vendor, and no remediation path represents elevated real-world risk beyond the numerical score alone. The primary real-world constraint is the PR:L requirement - exploitation demands a valid low-privilege session on the management interface. On devices using factory-default or weak credentials, this barrier is trivially bypassed, effectively reducing the practical exploitation difficulty to that of an unauthenticated attack. EPSS data was not provided in the input and cannot be assessed.

An attacker who has obtained low-privilege credentials to the UTT HiPER 1250GW management interface - through default factory credentials, credential stuffing, or phishing - sends a crafted HTTP POST request to /goform/APSecurity_5g with a cipher parameter value exceeding the fixed stack buffer size. The unsafe strcpy call overwrites the return address on the stack, and upon function return, execution is redirected to attacker-controlled shellcode or a ROP gadget chain. A public proof-of-concept demonstrating this technique is available at https://github.com/7wkajk/CVE-VUL/blob/main/101.md.