Description

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-19T03:16:52.900Z",
  "pubdate": "2026-08-19T03:16:52.900Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the UTT HiPER 1250GW router up to version 3.2.7-210907-180535. The flaw resides within the HTTP Handler component, specifically inside the file /goform/aspApBasicConfigUrcp, when processing the pvid argument via the vulnerable strcpy function. This security defect allows a remote attacker to trigger a memory corruption condition by supplying a specially crafted payload that exceeds the bounds of the allocated stack buffer.\nThe primary impact of this vulnerability is potential remote code execution, denial of service, and full compromise of the affected routing device. Because the attack can be initiated remotely over the network, it poses severe risk implications for network infrastructure integrity and confidentiality. Exploitation of this flaw requires no prior authentication or administrative privileges if the HTTP service is exposed, making it a high-severity target for threat actors. Public disclosure of the exploit increases the likelihood of active exploitation in the wild, necessitating immediate defensive measures.",
  "technicalDetails": "The vulnerability stems from unsafe string manipulation practices within the binary logic handling HTTP requests on the UTT HiPER 1250GW. Specifically, the HTTP Handler processes input parameters associated with the /goform/aspApBasicConfigUrcp endpoint. Within this routine, the function strcpy is utilized to copy the value supplied in the pvid argument directly into a fixed-size stack buffer without performing any boundary checks or input length validation.\nThe root cause is the inherent lack of bounds checking in the legacy C library function strcpy, which continues copying source data until a null terminator is encountered. When an attacker submits an HTTP request containing an excessively long string within the pvid parameter, the incoming data overflows the boundaries of the local stack buffer. This overflow overwrites adjacent stack memory structures, including saved frame pointers and return addresses.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious HTTP GET or POST request targeting the /goform/aspApBasicConfigUrcp URI. Second, the attacker populates the pvid argument with a payload engineered to exceed the predefined buffer length, frequently incorporating shellcode designed to execute arbitrary system commands or arbitrary code. Third, the HTTP Handler parses the request and passes the oversized pvid parameter to the vulnerable strcpy function. Fourth, the unconstrained copy operation overwrites the stack frame, redirecting the execution flow upon function return to the attacker-supplied shellcode.\nThe vulnerable component is the HTTP Handler managing the /goform/aspApBasicConfigUrcp file, affecting firmware versions up to 3.2.7-210907-180535. The attack vector is entirely network-based, allowing remote exploitation without requiring local access, user interaction, authentication, or elevated privileges, provided the management interface or HTTP daemon is reachable by the attacker."
}