Description

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-08-24T02:17:04.650Z",
  "pubdate": "2026-08-24T02:17:04.650Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in the UTT HiPER 1250GW router running firmware versions up to 3.2.7-210907-180535. This security flaw resides within the HTTP Request Handler component, specifically inside the /goform/aspRemoteApConfTempSend endpoint during the processing of the Profile argument. The vulnerability arises from an unsafe string copy operation utilizing the vulnerable strcpy function, which fails to bound-check incoming input against the allocated destination stack buffer. Successful exploitation of this vulnerability allows remote, unauthenticated attackers to execute arbitrary code, manipulate control flow data, or induce a complete denial of service through memory corruption. Given that the exploit vector is accessible over the network and exploits publicly available exploit methodologies, the risk implication is severe, potentially leading to total compromise of the affected device and subsequent pivoting into the internal network.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow occurring within the binary logic of the HTTP Request Handler component of the UTT HiPER 1250GW router. The root cause of the flaw is the improper usage of the non-bounded string manipulation function strcpy within the handler processing the /goform/aspRemoteApConfTempSend URI path. Specifically, when handling HTTP requests directed at this endpoint, the application extracts the value supplied in the Profile argument without implementing explicit length validations or bounds checks.\nThe attack flow begins with a remote attacker crafting a malicious HTTP request containing an overly long payload targeted at the Profile argument within the /goform/aspRemoteApConfTempSend function. Because the underlying implementation utilizes strcpy to copy the input string into a fixed-size stack buffer, the excessively large payload exceeds the allocated boundary of the buffer. This overflow overwrites adjacent stack memory, including critical data structures such as saved frame pointers and return addresses.\nWhen the affected function attempts to return execution control, the overwritten return address is loaded into the instruction pointer, allowing the attacker to redirect execution flow to shellcode contained within the payload or to execute arbitrary Return-Oriented Programming (ROP) chains. The affected product versions include UTT HiPER 1250GW up to 3.2.7-210907-180535. The vulnerability is exploitable remotely over the network without requiring prior authentication or specific user privileges, significantly lowering the barrier to exploitation. Post-exploitation impact includes persistent remote code execution with the highest privilege level, device instability resulting in frequent crashes, and potential interception or tampering of network traffic traversing the compromised device."
}