UTT HiPER 1200GW EUVD-2026-64692

The attacker must have network reachability to the UTT HiPER 1200GW web management interface (TCP port 80 or 443 depending on configuration) and must possess valid management credentials sufficient for at least low-privilege access to the device - consistent with CVSS 4.0 PR:L. The vulnerable endpoint /goform/formConfigFastDirectionW is part of the standard web GUI and does not require any non-default feature to be enabled; it is present in default firmware deployments. If remote (WAN-side) management is disabled - which is not the default on all firmware builds - exploitation is limited to LAN-adjacent attackers. Firmware must be version 2.5.3-170306 or earlier; no patched version exists to define a safe upper bound.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 7.4, reflecting low attack complexity and full device impact tempered by a low-privilege authentication requirement (PR:L). The presence of a public proof-of-concept on GitHub materially lowers the practical skill bar for exploitation - any operator of this device must treat this as a near-term operational risk regardless of the authentication prerequisite. EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified from that signal; this is a data gap. KEV status is absent, meaning CISA has not confirmed observed active exploitation at time of analysis, though this absence is not a reliable safety indicator given the freshness of the disclosure. The full VC:H/VI:H/VA:H impact on a gateway appliance is particularly consequential: full device compromise enables network interception, configuration tampering, and use of the device as a lateral-movement pivot into the protected LAN. The primary mitigating factor is the PR:L requirement, which blocks opportunistic unauthenticated mass exploitation but leaves the device exposed to credential-reuse attacks, insider threats, and scenarios where default credentials have not been changed.

An attacker with valid management credentials - obtained via default credential reuse, brute force, or insider access - sends a crafted HTTP POST request to /goform/formConfigFastDirectionW containing an SSID value significantly longer than the receiving buffer. The strcpy call copies the full input without truncation, overwriting adjacent stack memory including the return address. With a public proof-of-concept available on GitHub, the attacker can adapt existing exploit code to redirect execution to shellcode or ROP gadgets, gaining root-level command execution on the embedded device OS.