31
CVEs
1
Critical
21
High
0
KEV
22
PoC
22
Unpatched C/H
0.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
21
MEDIUM
8
LOW
1
Monthly CVE Trend
Affected Products (14)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-76003 | Stack-based buffer overflow in UTT HiPER 1200GW firmware through version 2.5.3-170306 enables remote code execution via a crafted timestart parameter submitted to the /goform/formGroupConfig endpoint. The root cause is an unbounded strcpy() call (CWE-121) in the formGroupConfig handler that overwrites stack memory without validating input length. A public proof-of-concept exploit has been published to GitHub, and the CVSS 4.0 score of 8.6 with high impact across both the vulnerable device and subsequent network systems underscores the potential for network-wide compromise through this gateway appliance. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-76004 | Stack-based buffer overflow in UTT HiPER 1250GW firmware (versions through 3.2.7-210907-180535) allows remote, low-privilege authenticated attackers to execute arbitrary code by submitting an oversized pvid argument to the /goform/aspApBasicConfigUrcp HTTP handler endpoint. The vulnerable strcpy() call performs no bounds checking, enabling stack memory corruption including return address overwrite. A public proof-of-concept exploit is available on GitHub, and the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H) indicate a compromised gateway can affect the confidentiality, integrity, and availability of downstream networked systems. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-78169 | Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis. | HIGH | 8.6 | 0.4% | 63 |
PoC
No patch
|
| CVE-2026-18895 | Stack-based buffer overflow in UTT HiPER 1250GW firmware (all versions through 3.2.7-210907-180535) enables low-privileged remote attackers to corrupt stack memory and achieve arbitrary code execution by submitting an oversized value to the cipher parameter of the /goform/APSecurity_5g endpoint. A public proof-of-concept exploit is available on GitHub, materially increasing opportunistic abuse risk. No vendor patch exists - the vendor failed to respond to responsible disclosure - leaving no fix-based remediation path at time of analysis. | HIGH | 7.4 | 0.6% | 58 |
PoC
No patch
|
| CVE-2026-18897 | Stack-based buffer overflow in the UTT HiPER 1250GW firmware (all versions up to v3.2.7-210907-180535) allows authenticated remote attackers to corrupt stack memory via the tempName argument of the /goform/getOneApConfTempEntry endpoint, with potential for arbitrary code execution on the device. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no patch path available. No CISA KEV listing exists, but the PoC availability combined with an unpatched network device significantly elevates practical risk for any exposed management interface. | HIGH | 7.4 | 0.6% | 58 |
PoC
No patch
|
| CVE-2026-18898 | Stack-based buffer overflow in UTT HiPER 1200GW firmware up to v2.5.3-170306 enables network-reachable authenticated attackers to corrupt stack memory and achieve arbitrary code execution on the device. The vulnerable C runtime function strcpy in the web management endpoint /goform/ConfigAdvideo performs no bounds validation on the timestart HTTP parameter, allowing oversized input to overwrite return addresses and redirect execution flow. A public proof-of-concept exploit is available on GitHub; no vendor patch exists as UTT did not respond to the coordinated disclosure. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-14721 | Stack-based buffer overflow in the UTT HiPER 1250GW SOHO router (firmware through 3.2.7-210907-180535) lets a network-adjacent attacker corrupt memory by supplying an oversized 'ssid' argument to the /goform/ConfigWirelessBase_5g web handler, potentially achieving code execution or a device crash. The flaw is remotely reachable via the device's web management interface and carries a CVSS 4.0 base score of 7.4 (PR:L, indicating some authentication to the web UI is expected). Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), though there is no public exploit identified as being actively used in the wild. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-19341 | Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-78170 | Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated attackers to corrupt memory by supplying an oversized SSID value to the /goform/formConfigFastDirectionW endpoint, which calls strcpy without bounds checking on user input. Full confidentiality, integrity, and availability impact on the device is possible, potentially enabling arbitrary code execution and pivoting into the network behind the gateway. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-10292 | Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware versions up to 2.5.3-170306) allows remote authenticated attackers to corrupt memory via the strcpy function in the /goform/formTaskEdit endpoint. Publicly available exploit code exists, raising the practical risk despite the requirement for low-level privileges. No KEV listing or EPSS data is provided in the input, so widespread automated exploitation has not been confirmed. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-10293 | Stack-based buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows authenticated remote attackers to corrupt memory via the Profile parameter in the /goform/formFireWall endpoint, where unsafe strcpy usage processes the input. Publicly available exploit code exists, increasing the realistic risk of attempted compromise against exposed management interfaces. No CISA KEV listing has been published, so exploitation is not yet confirmed active in the wild. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-11517 | Stack buffer overflow in UTT HiPER 2610G routers (firmware through 3.0.0-171107) allows authenticated remote attackers to corrupt memory by submitting an oversized GroupName parameter to the /goform/formConfigDnsFilterGlobal endpoint, which passes the input to an unsafe strcpy call. Publicly available exploit code exists (disclosed via VulDB and a GitHub PoC), and successful exploitation can compromise confidentiality, integrity, and availability of the device - typically meaning router takeover or denial of service. The issue is not listed in CISA KEV, so it is not confirmed actively exploited at this time. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-4487 | Unauthenticated attackers can trigger a buffer overflow in UTT HiPER 1200GW firmware versions up to 2.5.3-170306 via the /goform/websHostFilter endpoint, enabling remote code execution with full system compromise. Public exploit code is available and there is currently no patch, leaving affected devices at immediate risk. The vulnerability requires only network access and valid credentials to exploit, making it readily actionable for threat actors. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-4488 | Remote code execution in UTT HiPER 1250GW firmware versions up to 3.2.7 allows authenticated attackers to overflow a buffer in the /goform/setSysAdm function via a malicious GroupName parameter. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with valid credentials can achieve complete system compromise including code execution, data theft, and denial of service. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-4862 | Buffer overflow in UTT HiPER 1250GW firmware versions up to 3.2.7-210907-180535 allows authenticated remote attackers to achieve code execution through a malformed GroupName parameter in the DNS filter configuration handler. Public exploit code exists for this vulnerability and no patch is currently available. Affected organizations should restrict network access to administrative interfaces until remediation is possible. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|