UTT HiPER 1200GW EUVD-2026-54910

Exploitation requires low-privilege authentication to the HiPER 1200GW web management interface (PR:L per CVSS 4.0 vector) - the attacker must hold at minimum a guest-level or operator-level account on the device. The vulnerable endpoint /goform/pptpSrvGlobalConfig must be reachable, which is the case for any device exposing its management interface to the network. No user interaction is required (UI:N) and no specific attack prerequisites apply beyond authentication (AT:N, AC:L). Exploitation is limited by the authentication requirement; devices using default or widely known credentials effectively lower this bar. Devices where management access is restricted to a local management VLAN or out-of-band interface are not reachable via the network attack vector. No indication that PPTP must be actively configured or enabled beyond the endpoint being present in the web UI.

The CVSS 4.0 base score of 7.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects a network-accessible, low-complexity attack requiring only low-privilege authentication, with full confidentiality, integrity, and availability impact on the vulnerable device. The E:P supplemental metric confirms public exploit code exists, which meaningfully elevates practical risk beyond the base score alone. KEV status is not confirmed - CISA has not catalogued active exploitation at time of analysis - suggesting this has not yet reached widespread threat-actor adoption, though the gap between POC publication and weaponization is often short for embedded device vulnerabilities. The PR:L authentication requirement is the primary mitigating factor and the key signal separating this from a critical unauthenticated exposure; however, router/gateway devices frequently have default or weak credentials, which could effectively reduce this barrier. Scope change is absent (SC:N/SI:N/SA:N), meaning impact is contained to the device itself unless it is used as a pivot point. No EPSS data was provided in the input, so exploitation probability cannot be independently quantified.

An attacker holding low-privilege credentials on the UTT HiPER 1200GW management interface - obtained via default credentials, credential stuffing, or a prior foothold - sends a crafted HTTP POST request to /goform/pptpSrvGlobalConfig supplying an oversized EncryptionMode value. The unsafe strcpy() call overflows the stack buffer, overwriting the return address to redirect execution to attacker-controlled code, enabling arbitrary command execution at device-level privileges. A public PoC is available on GitHub (https://github.com/7wkajk/CVE-VUL/blob/main/104.md), making exploitation accessible to attackers with moderate skill.