Description

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-09T07:17:04.373Z",
  "pubdate": "2026-08-09T07:17:04.373Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability affects the UTT HiPER 1200GW router up to version 2.5.3-170306. The vulnerability resides in the pptpSrvGlobalConfig component and stems from unsafe string handling within the input processing logic. Specifically, the function strcpy is utilized to process the EncryptionMode parameter without implementing proper bounds checking, allowing an attacker to supply excessively long input strings that exceed the allocated stack buffer size.\nSuccessful exploitation of this flaw enables remote attackers to execute arbitrary code, overwrite critical stack memory, and potentially cause a denial of service by crashing the affected networking device. Because the attack vector is network-accessible, remote threat actors can target vulnerable endpoints without requiring prior authentication or localized physical access.\nThe risk implications are critical, as the compromise of core routing and gateway infrastructure can lead to network-wide surveillance, traffic interception, or complete loss of administrative control. Although the vulnerability has been publicly disclosed, the vendor failed to respond to early notifications regarding the security flaw, and no official vendor patches are available at this time, leaving deployed instances exposed unless compensating controls are enforced.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow, impacting the UTT HiPER 1200GW running firmware versions up to 2.5.3-170306. The flaw specifically targets the function strcpy located within the administrative binary handling the file path /goform/pptpSrvGlobalConfig. The root cause of the vulnerability is the inherent lack of input validation and bounds checking in the legacy strcpy function, which continues copying source data to the destination buffer until a null terminator is reached, regardless of the target buffer's allocated capacity.\nExploitation of this vulnerability occurs via the HTTP interface exposed over the network. An unauthenticated or remote attacker crafts a malicious HTTP request targeting the /goform/pptpSrvGlobalConfig endpoint, injecting an oversized payload into the vulnerable parameter designated as EncryptionMode. When the binary processes the incoming HTTP POST or GET parameters, it passes the user-controlled data directly to the vulnerable strcpy function without verifying the length of the string against the fixed-size stack buffer allocated for the configuration setting.\nAs the strcpy routine writes the excessive bytes past the boundary of the local stack buffer, adjacent memory structures on the stack are systematically overwritten. This includes critical execution context data such as saved frame pointers and return addresses. By carefully structuring the injected payload, an attacker can hijack the instruction pointer (PC) upon function return, redirecting execution flow to malicious shellcode contained within the payload or executing Return-Oriented Programming (ROP) chains.\nThe attack flow proceeds as follows: First, the remote attacker identifies a target UTT HiPER 1200GW device exposed to the network. Second, the attacker formulates an HTTP request destined for /goform/pptpSrvGlobalConfig, appending a crafted payload exceeding the expected length of the EncryptionMode argument. Third, the web server daemon parses the request and invokes the vulnerable function where strcpy copies the unbounded string onto the stack. Fourth, the stack corruption occurs, leading to either immediate application termination resulting in a denial of service, or successful code execution under the privileges of the http daemon or root context.\nGiven that the affected component handles PPTP global configuration settings, network exposure is inherent for devices accessible via WAN or LAN management interfaces. No authentication or elevated privileges are strictly required to interact with the vulnerable form handler, amplifying the severity of the threat landscape. Post-exploitation impact includes full system compromise, persistent unauthorized access, and capability to leverage the compromised gateway as a pivot point into the internal local area network."
}