Description

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T03:16:52.727Z",
  "pubdate": "2026-08-19T03:16:52.727Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the UTT HiPER 1200GW router up to version 2.5.3-170306. The vulnerability resides in the strcpy function within the /goform/formGroupConfig endpoint when processing the timestart argument. This flaw allows remote attackers to execute arbitrary code or trigger a denial of service condition by supplying a maliciously crafted payload that exceeds the bounds of the destination buffer. The risk implications are severe, as successful exploitation compromises the confidentiality, integrity, and availability of the affected network device. The attack can be executed remotely over the network without requiring prior authentication or privileged access, provided the vulnerable endpoint is accessible. Publicly available exploit material increases the likelihood of active exploitation in the wild, necessitating immediate remediation or mitigation actions for all deployed instances of the affected product.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow resulting from unsafe memory handling within the firmware of the UTT HiPER 1200GW. The root cause of the flaw is the utilization of the standard C library function strcpy within the vulnerable file /goform/formGroupConfig. The strcpy function inherently lacks bounds checking, copying the null-terminated string provided in the HTTP request parameter timestart directly into a fixed-size stack buffer allocated within the function's stack frame.\nThe affected component is the group configuration handler processing the /goform/formGroupConfig URI. Affected versions include all firmware iterations up to and including 2.5.3-170306. The attack vector is entirely network-based, allowing remote threat actors to interact directly with the web management interface of the device. Exploitation does not require authentication or specific privilege levels, lowering the barrier to entry for potential attackers.\nThe attack flow proceeds as follows: an unauthorized remote attacker crafts a malicious HTTP request targeting the /goform/formGroupConfig endpoint. Within this request, the timestart parameter is populated with an oversized payload consisting of a string significantly longer than the allocated destination buffer on the stack. When the web server daemon parses the input and passes the timestart argument to the vulnerable strcpy function, the input data overflows the boundaries of the local stack buffer.\nAs the overflow occurs, critical stack metadata, including the saved frame pointer and the return address, is overwritten with attacker-controlled data. Upon completion of the function execution, the processor attempts to restore the corrupted return address, redirecting execution flow to an attacker-specified memory location. Depending on the memory protections compiled into the binary, this can lead to arbitrary code execution within the context of the running web service process, or alternatively result in a segmentation fault causing a denial of service via device crashes and reboots. Post-exploitation impact includes full administrative compromise of the routing hardware, enabling traffic interception, pivoting into internal networks, or permanent firmware corruption."
}